All practice questions

A company is designing a global traffic routing and failover solution for a web application deployed in the East US and West Europe regions. The application must support SSL termination at the global tier and must route traffic to different backend pools based on the URL path. If a regional outage occurs, the solution must fail over to the remaining healthy region in less than 30 seconds. Which two components should you include in the design to meet these requirements? (Select two.)

An organization is designing a business continuity and disaster recovery strategy for an enterprise web application deployed in the East US and West US regions.

The application must meet the following requirements:
- Route incoming HTTP requests to the closest healthy region based on latency.
- Support SSL offloading at the network edge and route traffic based on URL paths.
- Maximize availability by routing traffic away from an unhealthy region within seconds without relying on client-side DNS cache expiration.
- Provide automatic failover for the backend Azure SQL Database to the secondary region using a single connection string listener.

Which architecture solution should you recommend?

A healthcare provider is deploying a multi-tier clinical application across two Azure regions: East US 2 and West US 2.

The architecture team specifies the following technical requirements for the application:
1. Global Traffic Ingress: Client traffic must be dynamically routed to the closest healthy region based on latency. The ingress layer must support SSL/TLS termination, URL path-based routing (routing `/api/*` traffic to API clusters and `/static/*` traffic to static assets), and Web Application Firewall (WAF) protection at the network edge.
2. Regional Backend Load Balancing: In each region, internal services communicating over TCP port 5005 must be load balanced across a backend pool of virtual machines. The load balancer must support High Availability (HA) ports.
3. Administrative Access: During a temporary transition phase, the backend virtual machines must maintain their existing direct administrative access using Basic SKU public IP addresses attached to their network interfaces.

You need to design a load balancing and delivery solution that satisfies all of the application's requirements while ensuring the deployment passes Azure validation.

Which two of the following components or configurations should you include in the design?

An enterprise has a hub-and-spoke network topology in Azure to support a multi-tier application. The topology contains the following configurations:

* Hub VNet (`vnet-hub-weur`): Address space $10.100.0.0/16$. It contains an Azure Route Server and a Network Virtual Appliance (`nva-core` at $10.100.1.4$) that dynamically advertises the prefix $192.168.10.0/24$ via BGP.
* Spoke VNet (`vnet-prod-spoke`): Address space $10.101.0.0/16$. It contains a subnet named `subnet-prod` ($10.101.1.0/24$). The spoke VNet is peered with the hub VNet with gateway transit enabled so that it receives the routes propagated by the Route Server.
* **Security Scanner (`nva-scan` at $10.100.2.4$)**: Deployed in the hub VNet for inspecting traffic destined to specific security zones.

You need to design a routing solution for resources in `subnet-prod` to ensure that all traffic destined for the $192.168.10.0/24$ network is routed through the security scanner (`nva-scan`) instead of the core NVA (`nva-core`).

Which of the following configurations should you recommend?

An organization is designing the network security for an Azure environment. A subnet named Subnet1 in a virtual network named VNet1 hosts virtual machines that run batch processing jobs. The virtual machines must access Azure Key Vault and Azure SQL Database instances over their public endpoints. You need to configure a Network Security Group (NSG) associated with Subnet1 to restrict outbound traffic so that the virtual machines can access only these specific Azure services and are blocked from all other public internet destinations. The solution must minimize administrative overhead. Which two actions should you recommend?

A logistics corporation is migrating a core ERP and dispatch system to Azure. The system has two distinct components:
1. An HTTP/HTTPS web application that requires cookie-based session affinity, SSL/TLS termination at the load balancer, and routing traffic to different backend pools based on the URL path.
2. A high-throughput database replication service that communicates over a custom TCP port 1445 and requires regional high availability.

All backend virtual machines (VMs) for both components are deployed within a single virtual network in the North Europe region. The VMs are currently associated with Basic SKU Public IP addresses. The entire load balancing architecture must support availability zones for zone redundancy and must not trigger deployment validation failures.

Which configuration should you recommend to meet these requirements?

A healthcare provider stores patient diagnostic reports in an Azure Blob Storage General-purpose v2 (GPv2) account. The reports must be managed according to the following requirements:
- Reports are frequently accessed and updated during the first 14 days after creation.
- Between 15 and 180 days, reports are accessed occasionally. When requested, they must be available for immediate, sub-second retrieval.
- After 180 days, reports are rarely accessed, but must be retained for 7 years (2,555 days) to meet regulatory compliance. For these reports, a retrieval latency of several hours is acceptable.
- All reports must be deleted after 7 years.

You need to design a lifecycle management policy to minimize storage costs while meeting the access and retention requirements.

Which two actions should you include in the lifecycle management policy? (Select two.)

A company is designing a secure hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall with the private IP address $10.1.1.4$. The spoke virtual network uses the address space $10.2.0.0/16$ and contains two subnets: `Prod-App-Subnet` ($10.2.1.0/24$) hosting application virtual machines associated with the Application Security Group (ASG) `AppVM-ASG`, and `Prod-Db-Subnet` ($10.2.2.0/24$) hosting a private endpoint for an Azure SQL Database with the private IP address $10.2.2.5$.

The network security design must satisfy the following technical requirements:
1. All traffic from `Prod-App-Subnet` to the Azure SQL Database private endpoint must be routed through and inspected by the Azure Firewall.
2. The Network Security Group (NSG) associated with `Prod-App-Subnet` must allow outbound database traffic to the private endpoint while blocking all other outbound traffic to the public internet.
3. Administrative overhead for managing network rules and IP changes must be minimized.
4. Network security policies must be enforced on `Prod-Db-Subnet`.

Which configuration should you recommend to meet these requirements?

A healthcare provider is designing the compute topology for a critical telehealth video orchestration application on Azure. The workload will run on $4$ Azure Virtual Machines (VMs) that perform real-time transcoding and routing. The application has the following design requirements:

- The VMs must achieve an SLA of $99.99\%$ for virtual machine uptime.
- Network latency between the VMs must be minimized to ensure sub-millisecond synchronization of media feeds.
- The design must protect against localized datacenter failures.

Which two actions should you include in the design to meet the requirements? (Select two.)

A multinational finance company is designing a secure hybrid networking architecture in Azure. The architecture must connect their on-premises datacenter to an Azure virtual network ($VNet1$) via an ExpressRoute circuit. The company is deploying an Azure SQL Database named $FinanceDB1$ and wants to ensure that:

- VMs in $VNet1$ and on-premises database client tools can access $FinanceDB1$ privately.
- VMs in $VNet1$ are strictly blocked from accessing any other Azure SQL Database instances in any region (preventing database data exfiltration).
- The on-premises clients must resolve the private endpoint of $FinanceDB1$ using their existing local DNS servers.
- Administrative overhead and maintenance of custom DNS forwarder virtual machines must be minimized.

Which two configurations should you include in the design?

An enterprise has a hub-and-spoke virtual network topology in the West US 2 region. The hub virtual network, `vnet-usw2-hub` ($10.200.0.0/16$), contains an Azure Route Server and a pair of active-active network virtual appliances (NVAs) in the subnet `snet-usw2-nva` ($10.200.1.0/24$). The NVAs use BGP to peer with the Azure Route Server. The spoke virtual network, `vnet-usw2-spoke` ($10.201.0.0/16$), contains a subnet named `snet-usw2-app` ($10.201.1.0/24$) and is peered with `vnet-usw2-hub` with gateway transit enabled.

Initially, the NVAs advertise the on-premises range $172.16.0.0/12$ via BGP. To force all on-premises traffic from `snet-usw2-app` through the NVAs, a route table is associated with `snet-usw2-app` containing a user-defined route (UDR) for $172.16.0.0/12$ with the next hop set to the NVAs' internal load balancer IP address ($10.200.1.100$).

A new branch office is added on-premises, and the Virtual Network Gateway in `vnet-usw2-hub` dynamically learns the specific subnet route $172.20.100.0/24$ via ExpressRoute BGP propagation. Azure Route Server propagates this route to `vnet-usw2-spoke`. Security audits show that traffic from `snet-usw2-app` destined for the new branch ($172.20.100.0/24$) is bypassing the NVAs.

You need to ensure that traffic from `snet-usw2-app` to the new branch office is inspected by the NVAs.

What should you do?

A research institution stores daily climate simulation datasets in a General-purpose v2 (GPv2) Azure Blob Storage account. The datasets are initially written to the Hot storage tier. You are designing a lifecycle management policy to meet the following requirements:

* The datasets are frequently and actively analyzed for the first 60 days after they are generated.
* After 60 days, the datasets are rarely accessed but must be retained for exactly 7 years (2,555 days) to comply with data retention regulations.
* Any rare data retrieval after 60 days must be completed within a maximum of 15 hours.
* Storage costs must be minimized.

Which two actions should you include in the lifecycle management policy? (Select two.)

Your company, Aetheris Manufacturing, is designing a secure network architecture in Azure. The architecture consists of a Hub virtual network (VNet) and a Spoke VNet peered together. Subnet-App ($10.20.1.0/24$) in the Spoke VNet hosts virtual machines running a production application. Subnet-PrivateLink ($10.20.2.0/24$) in the Spoke VNet contains Private Endpoints for an Azure SQL Database (sqldb-prod.database.windows.net) and an Azure Key Vault (kv-prod.vault.azure.net). Public network access is disabled on both the SQL Database and the Key Vault. You must block all outbound traffic from Subnet-App to the public internet and ensure that the virtual machines can only communicate with the specific SQL Database and Key Vault instances. The solution must minimize administrative overhead. Which network security configuration should you recommend for Subnet-App?

A logistics company is designing the Azure compute virtualization infrastructure for its operations platform. The platform consists of two workloads:

* Workload A: A fleet telemetry ingestion service that runs continuously, requires a $99.99\%$ availability SLA, and cannot tolerate unexpected interruptions or evictions.
* Workload B: A monthly inventory forecasting simulation that can run asynchronously, can be paused and resumed, and must minimize costs as much as possible.

Which two compute configurations should you recommend to meet these requirements? (Select two.)

An organization named Apex Bioscience is designing a secure networking architecture for a high-performance computing workload. The workload runs on Azure Virtual Machines deployed in a subnet named AnalysisSubnet within a virtual network named VNet1. The virtual machines must read and write data to multiple company-owned Azure Storage accounts located in the East US region. The security architecture must satisfy the following technical constraints:
- Outbound network traffic from AnalysisSubnet to the Azure Storage accounts must remain on the Microsoft backbone network and never traverse the public internet.
- Virtual machines must be prevented from exfiltrating data to any unauthorized or external Azure Storage accounts.
- The solution must minimize administrative overhead to implement and maintain as new company-owned storage accounts are provisioned in the East US region.

Which security component should you recommend to meet these requirements?

Your company is designing a secure network architecture in Azure. You have a virtual network named VNet1 containing a subnet named AppSubnet. Virtual machines in AppSubnet must connect to Azure Key Vault and Azure Storage.

The security team has the following requirements:
- Direct public internet connectivity from AppSubnet must be blocked.
- Administrative overhead for maintaining IP address changes of Azure services must be minimized.
- Communication with Azure Storage and Azure Key Vault must be allowed, while all other outbound traffic is denied.

You decide to use a Network Security Group (NSG) associated with AppSubnet to control outbound traffic.

Which two configurations should you recommend for the Network Security Group (NSG) outbound rules? (Select two.)

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network is `vnet-hub-prod` ($10.10.0.0/16$) and hosts an Azure Firewall at $10.10.1.4$. The spoke virtual network is `vnet-spoke-app` ($10.20.0.0/16$) and contains two subnets: `subnet-web` ($10.20.1.0/24$) and `subnet-db` ($10.20.2.0/24$). The virtual networks are connected via Virtual Network Peering.

The administrator wants to route all traffic from `subnet-web` to `subnet-db` through the Azure Firewall for security inspection. To achieve this, the administrator creates a route table and associates it with `subnet-web`.

Which route configuration should be added to the route table to inspect traffic destined for `subnet-db` while ensuring that local traffic within `subnet-web` and traffic to other potential subnets in `vnet-spoke-app` continues to route directly within the virtual network?

An insurance firm is deploying a core claims auditing application on Azure Virtual Machines. The application requires a virtual machine uptime SLA of at least $99.99\%$ to meet regulatory compliance. The auditing process runs continuously and must not be interrupted by eviction. Which compute topology should you recommend to meet the SLA and operational requirements?

An organization is planning to migrate a business-critical application suite from an on-premises datacenter hosting physical servers and VMware vSphere virtual machines to Azure. During the assessment phase, the following technical requirements and constraints are identified:

* The backend database layer consists of multiple SQL Server databases on physical servers that perform cross-database queries, utilize SQL Server Agent for scheduled maintenance, and execute CLR assembly routines.
* The application servers are hosted on VMware vSphere VMs and have undocumented TCP connections to external partner APIs.
* For hybrid identity, users must authenticate against the on-premises Active Directory Domain Services (AD DS) in real time to meet security compliance, but the organization wants to minimize on-premises infrastructure footprint and administrative overhead.

Which combination of Azure Migrate assessment strategies, target database service tiers, and Microsoft Entra ID hybrid identity solutions should you recommend to meet all migration requirements?

You are designing a serverless processing pipeline for an IoT platform. Devices upload binary log files to an Azure Storage account. A custom executable packaged in a Linux container must run to extract anomaly metrics from each log file. The extraction process takes approximately 12 minutes per file. The solution must scale automatically based on demand, scale to zero when no logs are uploaded, and avoid any running compute charges when idle. Which hosting option should you select to meet these requirements?