Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 721Question →

Apex Manufacturing is designing the network security for a three-tier application deployed in Azure. The application's virtual machines are located in a subnet named AppSubnet within a virtual network named VNet1. The virtual machines must access an Azure Key Vault and an Azure SQL Database. You need to design the outbound security rules in the Network Security Group (NSG) associated with AppSubnet. The solution must meet the following requirements:
- Allow outbound traffic to Azure Key Vault and Azure SQL Database.
- Block all other outbound traffic to the public internet.
- Minimize administrative effort by avoiding the maintenance of explicit IP address ranges in the security rules.

Which two security rules should you configure in the NSG to allow the required outbound traffic?

Select all that apply

Show answer & explanation

Answer: An outbound security rule that allows traffic with the destination set to the AzureKeyVault service tag.; An outbound security rule that allows traffic with the destination set to the Sql service tag.

Answer

To allow the required outbound traffic while minimizing administrative effort, you must configure two outbound rules in the NSG: one allowing traffic to the AzureKeyVault service tag and another allowing traffic to the Sql service tag.
The correct solution uses the AzureKeyVault and Sql service tags as destinations in the outbound NSG rules. Service tags represent a group of IP address prefixes managed by Microsoft, satisfying the requirement to minimize administrative effort and avoid manual IP tracking. They allow traffic only to those specific Azure services, satisfying the security requirements.

Step-by-Step Solution

1
Identify the target Azure services requiring outbound connectivity.
The target services are Azure Key Vault and Azure SQL Database.
This determines which service tags or destination endpoints are needed.
2
Select the configuration method that minimizes administrative effort.
Service tags (AzureKeyVault and Sql) are selected instead of explicit public IP address ranges.
Service tags represent a group of IP address prefixes from a given Azure service and are managed automatically by Microsoft, reducing overhead.
3
Create the NSG rules for the AppSubnet.
Two allow rules are created: one with the AzureKeyVault service tag as the destination, and another with the Sql service tag as the destination.
This permits the required traffic while enabling a final deny rule for the Internet service tag to block all other public outbound traffic.

Key Concept

Using Network Security Group (NSG) Service Tags to secure outbound connectivity to Azure services.
Question 722Question →

A financial services company is planning the migration of its portfolio management system from an on-premises VMware vSphere environment to Azure. The system consists of three web servers, four application servers, and a backend SQL Server 2019 instance. The SQL Server instance hosts three databases that perform cross-database queries and run several SQL Server Agent jobs. The application servers connect to external financial data feeds over non-standard TCP ports, but the port numbers and destinations are undocumented.

You need to recommend a migration assessment and target architecture design that minimizes operational effort and ensures application dependencies are fully mapped before migration.

Which combination of Azure Migrate dependency analysis and Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure Migrate agentless dependency analysis for the virtual machines, and Azure SQL Managed Instance for the database tier.

Answer

Azure Migrate agentless dependency analysis for the virtual machines, and Azure SQL Managed Instance for the database tier.
The correct recommendation is agentless dependency analysis for the VMware VMs combined with Azure SQL Managed Instance for the databases. Agentless dependency analysis allows mapping TCP connections directly through the Azure Migrate appliance without deploying software agents to the guest operating systems, meeting the requirement to minimize operational overhead. Azure SQL Managed Instance natively supports SQL Server Agent jobs and cross-database queries, which are critical requirements for the backend database tier.

Step-by-Step Solution

1
Analyze database requirements
Identified requirements for cross-database queries and SQL Server Agent jobs.
These are instance-level SQL Server features not supported by default in Azure SQL Database, pointing to Azure SQL Managed Instance as the correct target.
2
Analyze dependency assessment requirements
Identified the need to map undocumented TCP connections while minimizing operational effort on VMware VMs.
Azure Migrate agentless dependency analysis allows connection mapping without installing guest agents, matching the operational efficiency goal.
3
Combine the optimal components
Select agentless dependency analysis paired with Azure SQL Managed Instance.
This combination successfully meets all application requirements and administrative constraints.

Key Concept

Selecting appropriate database migration targets and dependency assessment methods based on features and operational constraints.
Question 723Question →

An enterprise is designing a high-throughput gaming backend in Azure. The backend consists of two main workloads:

1. A game-session matchmaking service that communicates over secure HTTP/S on port 443443, requiring SSL/TLS termination, URL path-based routing (e.g., routing `/match/*` to a specific pool), and SQL injection protection. This service is hosted on Azure Virtual Machines.
2. A real-time game telemetry receiver that processes high-frequency custom TCP packets on port 90009000. This receiver is deployed on a separate group of Azure Virtual Machines. The VMs hosting the telemetry receiver are pre-configured with Basic SKU public IP addresses on their network interfaces to allow direct, un-load-balanced administrator access for debugging.

The solution must meet the following requirements:
- Use a single, public entry point for the matchmaking service that is highly secure and supports path-based routing.
- Load-balance the telemetry receiver traffic across the telemetry VMs while ensuring that the current debugging configuration using Basic SKU public IPs remains functional.
- Avoid configuration validation errors due to SKU mismatches.

Which two actions should you perform to implement the load balancing architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy an Azure Application Gateway v2 with a Standard SKU public IP address to load-balance the matchmaking service.; Deploy a Basic Load Balancer to load-balance the telemetry receiver traffic on port 90009000.

Answer

Deploy an Azure Application Gateway v2 with a Standard SKU public IP address to load-balance the matchmaking service, and deploy a Basic Load Balancer to load-balance the telemetry receiver traffic on port 90009000.
Deploying an Azure Application Gateway v2 with a Standard SKU public IP successfully fulfills the Layer 7 matchmaking service needs, including WAF protection and path-based routing. Deploying a Basic Load Balancer satisfies the Layer 4 TCP requirement for the telemetry receiver while accommodating the legacy Basic SKU public IPs on the backend VMs, avoiding SKU mismatch validation errors.

Step-by-Step Solution

1
Analyze matchmaking service requirements
Identify that Layer 7 routing, SSL/TLS termination, and WAF protection are required, pointing to Azure Application Gateway v2 with a Standard SKU public IP.
Application Gateway v2 operates at Layer 7 and integrates WAF features, but strictly requires Standard SKU public IPs.
2
Analyze telemetry receiver requirements and constraints
Identify that Layer 4 TCP load balancing is required, and the target VMs must retain their Basic SKU public IPs.
The custom protocol runs on TCP port 90009000, necessitating a Layer 4 load balancer.
3
Evaluate SKU compatibility for the telemetry receiver load balancer
Determine that a Standard Load Balancer cannot be used because it is incompatible with backend VMs that have Basic SKU public IPs on their NICs, meaning a Basic Load Balancer is the correct choice.
Mixing Standard Load Balancer with Basic SKU public IP configurations on VM network interfaces leads to deployment validation errors.

Key Concept

Azure load balancing SKU constraints and Layer 4 vs Layer 7 load balancer capabilities
Estimated Time:2m 30s
Question 724Question →

An energy utility provider is designing the compute infrastructure for a critical smart-grid telemetry ingestion service on Azure. The service runs on Azure Virtual Machines and requires a continuous uptime SLA of 99.99%99.99\% for the virtual machine instances. The solution must remain resilient against utility power grid failures affecting individual datacenters within the primary Azure region. Which compute deployment strategy should you recommend?

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones in the primary region.

Answer

Deploy the virtual machines across two or more Availability Zones in the primary region.
Deploying virtual machines across two or more Availability Zones provides a 99.99%99.99\% uptime SLA and protects the application from datacenter-level power and cooling failures by isolating instances in physically separate datacenters.

Step-by-Step Solution

1
Analyze the service availability requirements.
The target workload requires an uptime SLA of 99.99%99.99\% and must survive datacenter-level utility power outages.
This establishes the minimum infrastructure resilience level.
2
Evaluate the SLA and isolation boundaries of each Azure VM configuration option.
Single VMs offer 99.9%99.9\%, Availability Sets offer 99.95%99.95\% inside a single datacenter, and Availability Zones offer 99.99%99.99\% across physically isolated datacenters.
This identifies which Azure compute option satisfies both the 99.99%99.99\% SLA and the datacenter-level outage requirement.
3
Select the option that meets the requirements while ensuring steady-state production support.
Deploying standard virtual machines across two or more Availability Zones satisfies all requirements, while Spot VMs must be ruled out because they lack an SLA and are subject to immediate eviction.
This ensures the selected solution is viable for a production environment.

Key Concept

Azure Compute High Availability SLA and Redundancy Options
Estimated Time:1m 30s
Question 725Question →

Aventis Pharmaceuticals is designing a secure network architecture in Azure. The architecture includes a virtual network named VNet1 with a subnet named ProcessingSubnet. Virtual machines (VMs) in ProcessingSubnet must write processed data to an Azure Storage account in the same region. You need to recommend the outbound traffic security configuration for ProcessingSubnet that permits communication with the Azure Storage account while minimizing administrative effort when Azure Storage IP addresses change. Which configuration should you recommend?

Show answer & explanation

Answer: Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to the Storage Service Tag.

Answer

Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to the Storage Service Tag.
Configuring an outbound security rule in the Network Security Group (NSG) with the destination set to the Storage Service Tag allows direct communication with Azure Storage. Microsoft automatically updates the underlying IP addresses for the Service Tag, which fulfills the requirement to minimize administrative effort.

Step-by-Step Solution

1
Identify the requirement to minimize administrative effort during IP address changes for Azure Storage.
Determine that Service Tags are the standard Azure mechanism for grouping IP addresses of specific services.
Microsoft automatically updates the IP addresses within a Service Tag, removing the administrative burden of manual updates.
2
Evaluate the use of Network Security Groups (NSGs) for traffic filtering.
An NSG rule with the Storage Service Tag as the destination allows outbound traffic to Azure Storage.
NSGs process outbound rules based on destination prefixes, and using a Service Tag matches all Storage endpoints in the region.
3
Discard options that introduce routing conflicts or SKU mismatches.
Avoid User Defined Routes that alter local system routes and avoid mixing Basic and Standard Load Balancer SKUs.
Overlapping routes disrupt local VNet traffic, and SKU mismatches cause deployment validation failures.

Key Concept

Using NSG Service Tags to filter outbound traffic to Azure services with minimal administrative effort
Estimated Time:1m 30s
Question 726Question →

A logistics company is designing an Azure compute virtualization solution for its fleet management platform. The platform has two main requirements:

1. A core telemetry ingestion engine that runs continuously, requires consistent performance, must achieve a 99.99%99.99\% availability SLA, and requires memory-optimized virtual machines.
2. A daily route-optimization analysis job that runs for approximately 44 hours, is tolerant to interruptions, and should be implemented with the lowest possible cost.

Which two compute configurations should you include in the design?

Select all that apply

Show answer & explanation

Answer: Azure Reserved Virtual Machines using Esv5-series VMs distributed across multiple Availability Zones for the telemetry ingestion engine; Azure Spot Virtual Machines using Fsv2-series VMs for the route-optimization analysis job

Answer

The correct configurations are to use Azure Reserved Virtual Machines using Esv5-series VMs distributed across multiple Availability Zones for the telemetry ingestion engine, and Azure Spot Virtual Machines using Fsv2-series VMs for the route-optimization analysis job.
The correct configurations combine Azure Reserved Virtual Machines using Esv5-series VMs distributed across multiple Availability Zones for the telemetry ingestion engine with Azure Spot Virtual Machines using Fsv2-series VMs for the route-optimization analysis job. The telemetry engine is a continuous, steady-state workload requiring a memory-optimized series and a high SLA (99.99%99.99\%), which is achieved by deploying across multiple Availability Zones. Reserved instances reduce cost for this continuous running resource. The route-optimization job runs for a short duration and can tolerate interruptions, making Spot VMs the most cost-effective option.

Step-by-Step Solution

1
Analyze the requirements for the telemetry ingestion engine.
The engine is a steady-state workload requiring continuous performance, a memory-optimized profile, and high availability (99.99%99.99\% SLA).
This establishes that we need a memory-optimized VM series (like Esv5-series) deployed in a zone-redundant configuration with a purchasing model suitable for continuous operations (like Reserved Instances to minimize cost).
2
Analyze the requirements for the route-optimization analysis job.
The job runs for 44 hours daily, is compute-intensive, can tolerate interruptions, and needs the lowest cost.
This indicates that Spot VMs (which provide deep discounts for interruptible workloads) paired with a compute-optimized VM series (like Fsv2-series) are the best fit.
3
Evaluate the distractors against these requirements.
Using Spot VMs for the telemetry engine risks eviction and violates the SLA. Deploying the telemetry engine in a single Availability Zone lacks redundancy. Azure Functions Consumption plan times out after 1010 minutes, failing the 4-hour runtime requirement.
This confirms that only the selected options meet all performance, SLA, and duration constraints.

Key Concept

Selecting Azure VM series, purchasing models, and redundancy strategies based on SLA, duration, performance, and cost constraints.
Question 727Question →

A financial services company is designing a serverless backend for an automated risk assessment platform. The platform requires two distinct processing workloads:

1. A customer risk scoring API that receives payload data, performs quick database lookups, and returns results in under 5 seconds. The API experiences unpredictable traffic spikes but must maintain sub-second response times by minimizing cold starts, and it must securely access a backend database using virtual network integration.
2. A nightly portfolio simulation engine that runs complex Monte Carlo simulations. Each simulation run takes approximately 25 minutes to execute, requires 4 vCPUs and 16 GB of memory, and must run on demand using containerized workloads without maintaining active server infrastructure or incurring significant operational management overhead when idle.

Which two Azure solutions should you recommend to host these workloads? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Functions on a Premium plan to host the customer risk scoring API.; Azure Container Apps Jobs to run the portfolio simulation engine.

Answer

Azure Functions on a Premium plan to host the customer risk scoring API, and Azure Container Apps Jobs to run the portfolio simulation engine.
The correct architecture uses Azure Functions on a Premium plan for the API because it supports pre-warmed instances to mitigate cold starts and supports regional virtual network integration. It uses Azure Container Apps Jobs for the simulation engine because Container Apps Jobs run containerized tasks to completion, allow custom CPU/memory shapes, run for durations exceeding 10 minutes (up to 24 hours), and scale to zero without the management overhead of an AKS cluster.

Step-by-Step Solution

1
Evaluate the customer risk scoring API requirements.
The API requires rapid scaling, minimized cold starts (pre-warmed instances), and outbound virtual network integration.
Azure Functions on a Premium plan satisfies all these criteria while maintaining a serverless model.
2
Evaluate the portfolio simulation engine requirements.
The engine needs to run containerized simulations for 25 minutes with specific resource allocations (4 vCPUs and 16 GB memory) and scale to zero without high management overhead.
Azure Container Apps Jobs run containerized workloads to completion, support execution times up to 24 hours, allow custom CPU/memory shapes, and scale to zero without the overhead of AKS.

Key Concept

Selecting appropriate serverless hosting plans and container services based on execution timeouts, resource requirements, virtual network integration, and operational overhead.
Question 728Question →

An international financial services firm plans to transition its on-premises customer portal to Microsoft Azure. The portal is hosted on VMware vSphere 7.0 virtual machines. The underlying database runs on Microsoft SQL Server 2022 and relies heavily on cross-database queries and several SQL Server Agent jobs. To comply with the firm's strict security regulations: 1. No software agents may be installed on any production virtual machines at any stage of the assessment or discovery process. 2. Synchronized user credentials must not leave the on-premises boundary, meaning no password hashes (even encrypted) can be synchronized to the cloud. 3. The deployment of complex on-premises federation infrastructures, such as Active Directory Federation Services (AD FS), is strictly prohibited. Which combination of dependency assessment strategy, database migration target, and hybrid identity synchronization mechanism should you recommend?

Show answer & explanation

Answer: Agentless dependency analysis, Azure SQL Managed Instance, and Pass-through Authentication (PTA)

Answer

The correct recommendation is agentless dependency analysis, Azure SQL Managed Instance, and Pass-through Authentication (PTA).
The correct recommendation is agentless dependency analysis, Azure SQL Managed Instance, and Pass-through Authentication (PTA). This option meets all technical and organizational constraints: agentless dependency mapping is native to Azure Migrate for VMware VMs and requires no agent installations; Azure SQL Managed Instance provides compatibility with SQL Server Agent jobs and cross-database queries; and Pass-through Authentication provides hybrid sign-in without uploading password hashes to the cloud or requiring complex Active Directory Federation Services (AD FS) deployments.

Step-by-Step Solution

1
Determine the appropriate dependency assessment mechanism based on VM agent restrictions.
Since the source VMs run on VMware vSphere and agents are forbidden, agentless dependency analysis via Azure Migrate is the only compliant option.
Agent-based dependency analysis requires deploying the Dependency Agent and Log Analytics Agent, which violates the security constraint.
2
Evaluate the database tier requirements against Azure SQL options.
Azure SQL Managed Instance is chosen as the target database tier.
The database uses cross-database queries and SQL Server Agent jobs, which are not supported in Azure SQL Database but are fully supported in Azure SQL Managed Instance.
3
Identify the hybrid identity integration solution matching the security and infrastructure guidelines.
Pass-through Authentication (PTA) is selected.
PTA validates passwords directly on-premises without storing password hashes in Entra ID (satisfying the security rule), and it does not require deploying AD FS servers (satisfying the simplicity rule).

Key Concept

Mapping multi-dimensional constraints (agentless discovery, legacy SQL engine features, and zero-cloud-password-hash storage rules) to compatible Azure assessment, database, and identity solutions.
Estimated Time:2m 30s
Question 729Question →

An enterprise is designing a hybrid networking solution in Azure. The architecture includes:
- A hub virtual network named `vnet-hub-eus` (10.150.0.0/1610.150.0.0/16) that hosts a Virtual Network Gateway connected to an on-premises network.
- A spoke virtual network named `vnet-prod-eus` (10.160.0.0/1610.160.0.0/16) containing two subnets: `subnet-web` (10.160.1.0/2410.160.1.0/24) and `subnet-app` (10.160.2.0/2410.160.2.0/24).
- Virtual network peering configured between `vnet-hub-eus` and `vnet-prod-eus` with gateway transit enabled.

The enterprise has the following requirements:
- All outbound internet traffic from `vnet-prod-eus` must be redirected through the Virtual Network Gateway to the on-premises firewall for inspection.
- All traffic between `subnet-web` and `subnet-app` must route directly between the subnets and must not traverse the gateway or on-premises network.

You need to design a routing solution using a custom Route Table associated with both subnets in `vnet-prod-eus`.
Which route configuration should you specify in the Route Table?

Show answer & explanation

Answer: A route for 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual network gateway.

Answer

A route for 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual network gateway.
Defining only a default route (0.0.0.0/00.0.0.0/0) pointing to the Virtual Network Gateway implements forced tunneling for all internet-destined traffic. Under Azure's longest prefix match algorithm, the system route for local VNet traffic (10.160.0.0/1610.160.0.0/16 with next hop 'Local') is more specific than the default route (0.0.0.0/00.0.0.0/0). Therefore, traffic between local subnets continues to route directly within the VNet without traversing the gateway, perfectly satisfying all requirements.

Step-by-Step Solution

1
Analyze Azure's default routing behavior for virtual networks.
By default, Azure creates system routes for local virtual network communication (such as 10.160.0.0/1610.160.0.0/16 to next hop Local) and direct internet access (0.0.0.0/00.0.0.0/0 to next hop Internet).
Understanding system routes is necessary to determine what custom routes (User-Defined Routes) must be added and what system routes should be left unchanged.
2
Address the forced tunneling requirement for outbound internet traffic.
A custom route for 0.0.0.0/00.0.0.0/0 (the default route representing all internet-bound traffic) is added to the Route Table with the next hop set to Virtual network gateway.
This route overrides the default system route for internet traffic, redirecting it to the gateway and onward to the on-premises firewall.
3
Evaluate the routing behavior for local traffic between the web and application subnets under the new Route Table configuration.
Local traffic destined for the 10.160.0.0/1610.160.0.0/16 address space will match the default system route (10.160.0.0/1610.160.0.0/16 -> Local) because its prefix length is longer and more specific than the default route prefix (0.0.0.0/00.0.0.0/0).
Since the system route for local traffic is more specific, adding no additional routes for the local VNet prefix ensures local traffic continues to flow directly between subnets without traversing the gateway.

Key Concept

Azure Longest Prefix Match (LPM) routing algorithm and User-Defined Route (UDR) precedence over system routes.
Estimated Time:1m 30s
Question 730Question →

An enterprise is designing a regional application architecture in the East US region. The application consists of two tiers:

- A web tier hosted on Azure Virtual Machines that requires SSL/TLS termination, URL path-based routing, and HTTP/S load balancing.
- A database tier hosted on Azure Virtual Machines that requires internal TCP load balancing.

All virtual machines in the database tier currently have Basic SKU Public IP addresses assigned.

You need to recommend the load balancing services and the required configuration changes to support this architecture. Which two actions should you recommend?

Select all that apply

Show answer & explanation

Answer: Deploy Azure Application Gateway to load balance the web tier.; Deploy a Standard Azure Load Balancer to load balance the database tier, and upgrade the database virtual machines' Public IP addresses to Standard SKU.

Answer

To support this architecture, you should deploy Azure Application Gateway to load balance the web tier, and deploy a Standard Azure Load Balancer to load balance the database tier while upgrading the database virtual machines' Public IP addresses to Standard SKU.
Deploying Azure Application Gateway satisfies the Layer 7 requirements (SSL/TLS termination and URL path-based routing) for the web tier. Deploying a Standard Azure Load Balancer meets the database tier's Layer 4 TCP load balancing needs, and upgrading the virtual machines' Public IPs to the Standard SKU ensures SKU compatibility and avoids validation errors.

Step-by-Step Solution

1
Determine the requirements for the web tier.
The web tier requires URL path-based routing and SSL/TLS termination, which are Layer 7 features. Azure Application Gateway is the appropriate regional load balancer for these capabilities.
Layer 4 load balancers like Azure Load Balancer cannot perform content routing or SSL/TLS offloading.
2
Determine the load balancing requirements for the database tier.
The database tier requires internal TCP load balancing, which is a Layer 4 capability. A Standard Azure Load Balancer is suitable for this regional backend traffic.
Standard Azure Load Balancer provides low-latency Layer 4 distribution.
3
Evaluate SKU compatibility constraints for the database tier.
Because the virtual machines currently use Basic SKU Public IPs, they cannot be added to the backend pool of a Standard Load Balancer. They must be upgraded to Standard SKU Public IPs.
Azure enforces SKU consistency within the load balancer configurations; mixing Basic and Standard SKUs results in configuration failures.

Key Concept

Choosing load balancing services based on OSI layer capabilities and ensuring matching resource SKUs to avoid validation errors.
Question 731Question →

An enterprise plans to migrate an on-premises multi-tier application to Azure. The application consists of 15 physical Linux (RHEL) servers running web and application services, and a backend PostgreSQL database cluster running on two physical Linux servers. The database architecture relies on cross-database queries.

You need to design a migration assessment and identity transition strategy that meets the following requirements:
- Discovers the servers and maps network connections between them to identify dependencies.
- Recommends the appropriate Azure target service for the database.
- Syncs on-premises Active Directory Domain Services (AD DS) user accounts to Microsoft Entra ID with the least administrative complexity.

Which two actions should you include in the assessment and transition strategy? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Deploy the Azure Migrate appliance on an on-premises server to discover the servers and perform agentless dependency analysis.; Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) to sync on-premises user accounts.

Answer

Deploy the Azure Migrate appliance on-premises to discover servers and perform agentless dependency analysis, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS) to sync user accounts.
Deploying the Azure Migrate appliance on-premises enables the discovery of physical Linux servers and maps their network connections agentlessly to identify server dependencies. To synchronize on-premises Active Directory accounts with the least administrative complexity, Microsoft Entra Connect with Password Hash Synchronization (PHS) is the ideal solution as it does not require additional on-premises identity federation infrastructure.

Step-by-Step Solution

1
Select the dependency analysis method
Implement the Azure Migrate appliance to perform agentless dependency analysis on the physical Linux servers.
Allows mapping of network connections between physical servers to create accurate migration groups without installing agents.
2
Select the identity sync mechanism
Choose Microsoft Entra Connect with Password Hash Synchronization (PHS).
Provides the lowest administrative overhead and complexity for syncing hybrid identities compared to federated options.

Key Concept

Selecting appropriate migration discovery and dependency tools alongside a low-overhead hybrid identity sync mechanism.
Question 732Question →

A company plans to migrate an on-premises payroll application running on physical servers to Azure. The application relies on a local Microsoft SQL Server database that utilizes SQL Server Agent jobs for nightly processing and performs cross-database queries. The company also needs to synchronize their on-premises Active Directory Domain Services (AD DS) identities to Microsoft Entra ID. The migration strategy must minimize administrative and infrastructure overhead, maintain application compatibility, and ensure that all server connections are identified before migration.

Which migration and identity synchronization strategy should you recommend?

Show answer & explanation

Answer: Migrate the database to Azure SQL Managed Instance, perform an agentless dependency analysis using Azure Migrate, and configure Microsoft Entra Connect with Password Hash Synchronization.

Answer

Migrate the database to Azure SQL Managed Instance, perform an agentless dependency analysis using Azure Migrate, and configure Microsoft Entra Connect with Password Hash Synchronization.
The correct strategy migrates the database to Azure SQL Managed Instance because it supports instance-level features like SQL Server Agent and cross-database queries. It uses Azure Migrate dependency analysis to ensure all connection vectors are verified before server migration. It utilizes Password Hash Synchronization (PHS) to sync identities with the least administrative and on-premises infrastructure overhead.

Step-by-Step Solution

1
Select the database migration target based on application features.
Choose Azure SQL Managed Instance.
The database relies on SQL Server Agent jobs and cross-database queries, which are fully supported natively on Azure SQL Managed Instance but restricted or unsupported on Azure SQL Database single databases.
2
Plan the network and server dependency assessment.
Perform dependency analysis using Azure Migrate.
A dependency analysis identifies all inbound and outbound server connections, ensuring no critical integrations are missed or broken during the migration of physical workloads.
3
Select the hybrid identity synchronization mechanism.
Configure Password Hash Synchronization (PHS) using Microsoft Entra Connect.
PHS requires the least amount of administrative and on-premises infrastructure overhead compared to Active Directory Federation Services (AD FS), satisfying the requirement to minimize operational overhead.

Key Concept

Selecting SQL database deployment tiers, dependency assessment methods, and hybrid identity architectures based on legacy application requirements and operational constraints.
Estimated Time:1m 30s
Question 733Question →

A multinational enterprise has workloads deployed in the East US and West Europe Azure regions. The enterprise must design a monitoring and log routing architecture that meets the following requirements:
1. All security logs must be analyzed using Microsoft Sentinel.
2. Data residency regulations dictate that logs generated by resources in West Europe must not leave the West Europe region.
3. The Security Operations (SecOps) team must be able to query security logs across both regions from a single query interface.
4. Development teams must only access diagnostic logs for the specific resources they manage. They must not have access to security logs or logs of resources owned by other teams.
5. Workspace administrative overhead and the number of Log Analytics workspaces must be minimized.

Which monitoring and log routing configuration should you recommend?

Show answer & explanation

Answer: Deploy one Log Analytics workspace in East US and one in West Europe. Enable Microsoft Sentinel on both workspaces, and query both workspaces centrally. Route resource diagnostic logs to these regional workspaces, and grant developers Read permissions on their specific Azure resources to enable resource-context log access.

Answer

Deploy one Log Analytics workspace in East US and one in West Europe. Enable Microsoft Sentinel on both workspaces, and query both workspaces centrally. Route resource diagnostic logs to these regional workspaces, and grant developers Read permissions on their specific Azure resources to enable resource-context log access.
The correct configuration establishes one regional Log Analytics workspace in East US and one in West Europe, which respects data residency requirements. By enabling Microsoft Sentinel on both, the SecOps team can query both workspaces centrally using cross-workspace queries. By granting developers Read permissions on their specific Azure resources, they can access their logs using resource-context RBAC. This avoids workspace sprawl and prevents unauthorized access to security logs or other resources' logs.

Step-by-Step Solution

1
Analyze regional data residency requirements.
Determined that at least two regional Log Analytics workspaces (one in East US and one in West Europe) must be deployed to ensure logs from West Europe do not leave the region.
Strict compliance guidelines require regional data sovereignty for West Europe resources.
2
Address the centralized security query requirement.
Configure Microsoft Sentinel on both workspaces and utilize cross-workspace querying capabilities to present a single pane of glass dashboard to SecOps.
Microsoft Sentinel supports querying across multiple workspaces within the same tenant, enabling centralized analysis without consolidating raw logs.
3
Design developer access control to logs.
Leverage resource-context Azure RBAC. Grant developers Read access to their specific resources instead of access to the workspace.
Resource-context RBAC allows users to query logs of resources they have read access to directly from the resource's blade or using resource-scoped queries, preventing access to logs of other resources or Sentinel security tables.
4
Minimize administrative overhead.
Consolidate to a single workspace per region for all resource logs instead of creating per-team or per-application workspaces.
Resource-context RBAC eliminates the need to isolate logs in separate workspaces for access control, minimizing workspace management overhead.

Key Concept

Designing a multi-region log routing architecture that balances regulatory data residency compliance, centralized security monitoring, and granular access control (resource-context RBAC) while minimizing workspace overhead.
Question 734Question →

Your company requires that all virtual machines deployed to a subscription automatically have the Log Analytics agent installed to ensure monitoring compliance. If a virtual machine is deployed without the agent, the agent must be automatically installed without blocking the deployment of the virtual machine itself. Which Azure Policy effect should you recommend to meet this requirement?

Show answer & explanation

Answer: DeployIfNotExists

Answer

DeployIfNotExists
The DeployIfNotExists effect checks if a related or child resource (such as a virtual machine extension) exists, and if not, it automatically triggers a deployment template to remediate the compliance gap. This allows the primary resource (the virtual machine) to be deployed successfully while automatically ensuring that the required extension is installed.

Step-by-Step Solution

1
Analyze the business requirement
The virtual machine deployment must not be blocked, but the missing Log Analytics agent must be automatically installed (remediated) when the virtual machine is created.
This establishes that we need a policy effect that can perform remediation (resource deployment) dynamically.
2
Evaluate the policy effects based on compliance action
The 'DeployIfNotExists' effect checks for the specified child resource (the agent extension) and executes an ARM template deployment to install it if it is missing, matching the requirement.
Choosing the correct effect ensures the design meets the goal with minimal administrative overhead.

Key Concept

Azure Policy effects determine what happens when a resource matches a policy definition during creation or update. The DeployIfNotExists effect enables automated deployment of dependent resources or extensions when they are missing, ensuring automated compliance without blocking the deployment of the primary resource.
Estimated Time:1m 0s
Question 735Question →

Your company requires that all new resource groups deployed to a production subscription must include a tag named 'CostCenter'. If an administrator attempts to create a resource group without this tag, Azure must immediately block the creation process. Which Azure Policy effect should you specify in the policy definition to meet this requirement?

Show answer & explanation

Answer: Deny

Answer

Deny
The correct answer is the option specifying the Deny effect. In Azure Policy, the Deny effect is designed to block any resource creation or update request that does not comply with the policy definition, ensuring immediate enforcement of compliance boundaries at the time of deployment.

Step-by-Step Solution

1
Analyze the compliance requirement.
The requirement states that resource creation must be immediately blocked if a specific tag ('CostCenter') is missing.
Understanding the desired action (blocking/prevention vs. monitoring or remediation) is key to selecting the correct Azure Policy effect.
2
Evaluate the capabilities of different Azure Policy effects.
The Deny effect prevents creation of non-compliant resources. The Audit effect only reports non-compliance. The DeployIfNotExists and Modify effects focus on remediation and alteration rather than blocking.
Comparing the policy effects determines which one aligns with the blocking requirement.
3
Select the policy effect that enforces the block.
The Deny effect is chosen because it directly blocks resource group creation when the 'CostCenter' tag is absent.
Deny is the only policy effect that prevents the deployment of non-compliant resources.

Key Concept

Azure Policy effects determine how Azure responds when a resource is evaluated against a policy rule. To prevent deployment of non-compliant resources, the Deny effect is used.
Question 736Question →

An organization has a web application deployed across two Azure regions: East US and North Europe.

The organization must comply with the following monitoring and compliance requirements:
- Data residency: Log data generated by resources in North Europe must reside within the European Union (EU). Log data generated in East US must reside within the United States.
- Access control: Security administrators in North Europe must only be able to view logs from North Europe. Security administrators in East US must only be able to view logs from East US.
- Policy enforcement: All new resources deployed in these regions must automatically have diagnostic settings configured to route logs to the appropriate destination without manual intervention.

You need to design a monitoring and governance solution that meets these requirements while minimizing administrative complexity.

Which solution should you recommend?

Show answer & explanation

Answer: Deploy one Log Analytics workspace in East US and another in North Europe. Configure diagnostic settings on regional resources to route to their local workspace. Assign access permissions to regional security administrator Microsoft Entra ID groups at the workspace scope. Deploy Azure Policy definitions using the DeployIfNotExists effect to configure diagnostic settings for new resources.

Answer

Deploy one Log Analytics workspace in East US and another in North Europe. Configure diagnostic settings on regional resources to route to their local workspace. Assign access permissions to regional security administrator Microsoft Entra ID groups at the workspace scope. Deploy Azure Policy definitions using the DeployIfNotExists effect to configure diagnostic settings for new resources.
The correct solution meets the data residency requirement by keeping European log data in the North Europe workspace and US log data in the East US workspace. It implements administrative isolation by assigning permissions at the workspace scope to distinct Microsoft Entra ID groups representing each region's administrators. Finally, it uses Azure Policy with a DeployIfNotExists effect, which is the correct effect to automatically create and configure diagnostic settings on newly deployed resources.

Step-by-Step Solution

1
Evaluate data residency and administrative isolation constraints.
Determine that a multi-workspace design (one in East US and one in North Europe) is required.
Log data must remain within regional boundaries to comply with sovereignty rules, and administrative isolation prevents cross-region access.
2
Determine the proper access delegation model.
Create Microsoft Entra ID security groups for regional administrators and assign them the Log Analytics Reader role at the workspace level.
Assigning RBAC roles to groups rather than individual user accounts aligns with identity governance and security principles.
3
Determine the Azure Policy effect for automatic diagnostic log routing configuration.
Use the DeployIfNotExists policy effect.
DeployIfNotExists allows Azure Policy to deploy diagnostic settings automatically when resources are created, whereas Deny blocks resource creation instead of remediating the configuration.

Key Concept

Designing regional Log Analytics workspace architectures to satisfy data residency and administrative isolation constraints, while automating compliance with group-based RBAC and DeployIfNotExists policy effects.
Question 737Question →

An organization has Azure resources deployed in both the United States and the European Union (EU). Legal compliance regulations require that all logs generated by EU resources remain stored within the EU, while US resource logs must reside in the US. Additionally, administrators must only access logs for their respective regions.

Which log routing and storage solution should you design to meet these requirements?

Show answer & explanation

Answer: Deploy one Log Analytics workspace in the US and a separate Log Analytics workspace in the EU, route the respective resource logs to each workspace, and manage access using Microsoft Entra ID groups.

Answer

Deploy one Log Analytics workspace in the US and a separate Log Analytics workspace in the EU, route the respective resource logs to each workspace, and manage access using Microsoft Entra ID groups.
The correct solution requires deploying separate Log Analytics workspaces in the US and the EU to satisfy the regional data residency requirements. Routing each region's resource logs to its local workspace keeps the data within the required boundaries. Managing workspace access via Microsoft Entra ID groups ensures secure, administrative segregation with minimal management overhead, aligning with Azure best practices.

Step-by-Step Solution

1
Analyze data residency constraints.
Identified that EU logs must be stored in the EU, and US logs must be stored in the US. This necessitates deploying separate Log Analytics workspaces in each region.
A single workspace cannot store data across different geographical regions simultaneously due to workspace region binding.
2
Configure log routing.
Configure Diagnostic Settings on resources in each region to route logs to their corresponding regional Log Analytics workspace.
Diagnostic settings determine the destination workspace for resource log streams.
3
Configure access control using best practices.
Assign Log Analytics Reader roles to Microsoft Entra ID groups representing US and EU administrators respectively.
Using groups for role assignment reduces administrative overhead compared to direct individual user assignments.

Key Concept

Data residency compliance and administrative isolation in Azure Monitor log routing design.
Estimated Time:1m 30s
Question 738Question →

An enterprise runs cloud workloads across two Azure regions: East US and North Europe.

The organization must comply with the following requirements:
- All resource diagnostic logs containing customer-identifiable information generated in North Europe must reside within the European Union due to data residency regulations.
- The central security operations center (SOC) team must analyze security and audit events from all regions collectively using Microsoft Sentinel.

Which monitoring and log routing configuration should you recommend?

Show answer & explanation

Answer: Create regional Log Analytics workspaces in East US and North Europe for resource diagnostic logs. Configure diagnostic settings to route resource logs to their respective regional workspaces, and route security and audit logs from both regions to a centralized Log Analytics workspace configured with Microsoft Sentinel.

Answer

Create regional Log Analytics workspaces in East US and North Europe for resource diagnostic logs. Configure diagnostic settings to route resource logs to their respective regional workspaces, and route security and audit logs from both regions to a centralized Log Analytics workspace configured with Microsoft Sentinel.
The correct architecture uses regional workspaces (East US and North Europe) for resource diagnostic logs containing sensitive customer data, complying with European residency regulations. Simultaneously, it routes security and audit logs from both regions to a centralized workspace configured with Microsoft Sentinel, allowing the SOC team to perform unified threat analysis.

Step-by-Step Solution

1
Analyze the data residency constraints for resource logs.
Resource diagnostic logs containing customer-identifiable information in North Europe must stay in Europe, requiring a local workspace in North Europe.
Data sovereignty regulations mandate that sensitive personal data cannot be transferred out of the region.
2
Determine the SOC requirement for centralized security analysis.
Security events and audit logs must be routed to a centralized workspace configured with Microsoft Sentinel.
Microsoft Sentinel requires a centralized Log Analytics workspace to perform effective cross-region security analytics and correlation.
3
Design the log routing architecture using diagnostic settings.
Configure Azure resources to route diagnostic logs regionally and security logs centrally.
Azure diagnostic settings support multiple destinations, allowing different categories of logs to be routed to different workspaces.

Key Concept

Log Analytics workspace design and diagnostic log routing configurations supporting both data residency and centralized security monitoring.
Estimated Time:1m 30s
Question 739Question →

An organization has Azure subscriptions in the East US and West Europe regions. The organization must design a monitoring and log routing architecture that meets the following requirements:

1. All resource diagnostic logs and Azure Activity logs must be retained for auditing.
2. Under no circumstances may log data generated by resources in the West Europe region be transferred to or stored in the United States, to comply with strict data sovereignty regulations.
3. The security team requires real-time streaming of all security-related log data from both regions to an external, third-party Security Information and Event Management (SIEM) system.
4. Future resources must automatically have diagnostic settings configured upon deployment to route logs to the appropriate destinations without administrative intervention.
5. Administrative overhead and costs must be minimized.

Which design should you recommend?

Show answer & explanation

Answer: Deploy a Log Analytics workspace and an Azure Event Hub in East US, and another Log Analytics workspace and Azure Event Hub in West Europe. Assign an Azure Policy definition with the DeployIfNotExists effect to automatically configure diagnostic settings routing to the local workspace and Event Hub. Configure the SIEM to retrieve logs from both regional Event Hubs.

Answer

Deploy regional Log Analytics workspaces and Event Hubs, and use Azure Policy with the DeployIfNotExists effect to automatically configure diagnostic settings routing logs locally.
The correct architecture uses regional Log Analytics workspaces and Event Hubs in both East US and West Europe. This complies with data residency rules by keeping European log data within Europe. Using Azure Policy with a DeployIfNotExists effect automatically provisions diagnostic settings upon resource deployment, ensuring compliance without blocking user actions. Regional Event Hubs facilitate real-time, low-latency streaming to the external SIEM.

Step-by-Step Solution

1
Analyze data residency constraints.
Separate Log Analytics workspaces and Event Hubs must be deployed in West Europe and East US to ensure West Europe data does not leave its region.
Data sovereignty regulations prohibit West Europe logs from being stored or transferred to the US.
2
Determine real-time streaming method to external SIEM.
Use Azure Event Hubs in each region as the routing target for diagnostic logs.
Event Hubs provide low-latency, real-time message streaming suitable for SIEM integration.
3
Evaluate policy mechanism for automatic enforcement.
Use Azure Policy with the DeployIfNotExists effect.
DeployIfNotExists automatically creates the diagnostic settings when resources are deployed, whereas Deny would only block deployment without setting them up.

Key Concept

Log routing architecture with geographic residency, real-time SIEM streaming, and policy-driven automation.
Question 740Question →

Your company has an Azure environment with a single subscription. You are designing an Azure Policy strategy to enforce the following governance and compliance requirements:
- Prevent the deployment of resources that do not have a required 'CostCenter' tag.
- Automatically deploy a diagnostic settings extension to new virtual machines to ensure monitoring compliance.

Which two Azure Policy effects should you use to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deny; DeployIfNotExists

Answer

Use the Deny effect to prevent resource creation without the required tag, and the DeployIfNotExists effect to automatically deploy the diagnostic settings extension to virtual machines.
To satisfy the governance requirements, the Deny effect is used to block resource deployment when the required tag is missing. The DeployIfNotExists effect is used to deploy a template or resource extension (like diagnostics settings) when a resource is created, providing automated remediation without manual intervention.

Step-by-Step Solution

1
Analyze the requirement to prevent the creation of non-compliant resources.
Identify that the Deny effect is the correct mechanism to block resource deployment when conditions (such as a missing tag) are not met.
This directly matches the requirement to prevent creation of resources without a 'CostCenter' tag.
2
Analyze the requirement to automatically deploy an extension to virtual machines upon creation.
Identify that the DeployIfNotExists effect is used to deploy nested resources or templates when the target resource is created.
This satisfies the requirement to ensure virtual machines are deployed with the diagnostic settings extension automatically.

Key Concept

Azure Policy effects determine what happens when a policy rule is evaluated during resource creation or modification.
PreviousPage 37 / 60Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin