All practice questions

A biotechnology company is designing an identity governance and privileged access strategy for its Azure environment.

The company has the following requirements:
- A team of five external data scientists must be granted the Virtual Machine Contributor role on a resource group named RG-Research for a duration of six months.
- The external data scientists must only have access when actively performing work, and all access requests must be logged.
- To prevent tenant lockout, the company must maintain two emergency access accounts that are bypassed by standard security controls.
- All administrative role assignments must adhere to the principle of least privilege and scale efficiently without direct user-to-role mappings.

Which two of the following configuration choices should you recommend to meet the requirements? Select TWO.

A healthcare provider is designing a new analytical data solution on Azure to integrate and process telemetry from medical sensors and daily diagnostic reports. The design must satisfy the following technical requirements:

* Diagnostic reports: $800\text{ GB}$ of compressed JSON files are uploaded as a batch once every $24\text{ hours}$.
* Exploratory analysis: Data analysts must be able to run ad-hoc, exploratory queries directly against the raw JSON batch files without incurring costs for idle compute resources.
* Disaster recovery: The raw analytical data must be resilient against a regional datacenter failure.
* Access control: External research partners must be granted temporary, read-only access to the raw data files. The access must be immediately revocable at any time without rotating the primary storage account keys.

Which combination of storage redundancy, analytical querying engine, and authorization mechanism should you recommend to meet these requirements?

A global media streaming platform is designing an analytical pipeline to process and analyze content viewing sessions. The platform requires a solution to store and query historical logs with the following characteristics:

* Daily batch uploads of session log files in Parquet format, totaling $5\text{ TB}$ of new data per day.
* A total of $800\text{ TB}$ of historical logs stored in a central repository.
* Data scientists must run sporadic, ad-hoc exploratory queries to analyze viewing trends, which can tolerate a query latency of up to $30\text{ seconds}$.
* The architecture must minimize administrative overhead and reduce costs by avoiding continuously running compute resources.
* The storage solution must remain resilient and survive a datacenter outage in the primary region.

Which two components should you include in the storage and query design?

You are designing a serverless container solution on Azure. The solution must host microservices with zero cluster management overhead and scale containers automatically based on the number of messages in an Azure Service Bus queue. Which two configurations or services should you recommend?

A financial services firm is designing the storage infrastructure for a new document archiving system. The system will store critical customer statements as Block Blobs in a general-purpose v2 storage account. The design must satisfy the following technical requirements:

- The storage solution must withstand the complete failure of an Azure availability zone in the primary region without any data loss or read/write service disruption.
- To protect against a regional disaster, the data must be replicated to a secondary paired region.
- In the event of a primary region outage, the application must be able to immediately read the archived documents from the secondary region without initiating a storage account failover and without waiting for Microsoft to declare a disaster.

Which redundancy option should you select for the storage account?

A logistics company, Zenith-Fleet, uses an Azure Storage v2 account to store critical telemetry logs. The system has the following requirements:
- Maximum read availability: Reads must be highly available even during a primary region outage.
- Recovery Point Objective (RPO) for writes: Less than $15$ minutes.
- Recovery Time Objective (RTO) for writes: Less than $1$ hour.
- Cost: Must minimize cross-region data transfer costs and redundancy costs.

To meet these requirements, the architect configured the account with Read-Access Geo-Redundant Storage (RA-GRS). The primary region (East US) experiences a catastrophic outage. The operations team observes that the storage account's `Last Sync Time` is $8$ minutes behind the current time. To restore write access within the RTO, the team plans to initiate a customer-managed failover to the secondary region (West US).

Which of the following correctly describes the write availability, DNS resolution, and redundancy behavior during and after the failover process?

A financial services company is designing a high availability (HA) and disaster recovery (DR) solution for a database workload currently on-premises. The workload requires cross-database queries and SQL Server Agent jobs. The solution must support:

* An RTO of $30$ minutes
* An RPO of $5$ seconds
* Automatic failover to a secondary Azure region
* A single connection string that does not change after failover
* Minimal administrative overhead

Which two actions should you recommend to meet the requirements?

You are designing the infrastructure for a database synchronization tool that runs as an Azure Function. The tool is triggered by a webhook and runs for up to 15 minutes per invocation. Which two Azure hosting options should you recommend to support this execution duration while minimizing operational overhead? (Select two.)

A healthcare software provider is designing a storage lifecycle strategy for medical imaging files stored in a general-purpose v2 (GPv2) Azure Blob storage account. The access patterns and requirements for the imaging files are as follows:

* For the first 30 days after creation, files are frequently accessed by clinicians and require immediate, sub-second retrieval.
* From day 31 to day 120, files are accessed occasionally for audits. Immediate, sub-second retrieval is still required during this period.
* After 120 days, files must be preserved for historical research. A retrieval latency of up to 15 hours is acceptable for these historical files.
* The solution must minimize storage and transaction costs.

Which lifecycle management policy configuration should you recommend?

A financial services company is designing a privileged access governance solution for its Azure environment. The solution must meet the following requirements:

* Members of the IT security department must be able to assume the Security Administrator role on a temporary basis, not exceeding 4 hours per session, requiring Multi-Factor Authentication (MFA) and Chief Information Security Officer (CISO) approval.
* An emergency 'break-glass' administrative account must be maintained to prevent tenant lockout, ensuring it is exempt from the standard MFA requirements in the event of an identity provider outage.
* Administrative overhead for managing individual user role assignments must be minimized.

Which combination of configuration actions should you recommend?

A startup is deploying a web application that stores user profile documents in an Azure General Purpose v2 (GPv2) storage account. The design requirements are as follows:

* The documents must remain highly available and survive the loss of an entire availability zone in the primary region without administrative intervention or failover.
* The documents must also be replicated to a secondary region to protect against a regional disaster.
* To control costs, the startup wants the most cost-effective option that meets these requirements and does not require read access to the secondary region under normal operations.

Which redundancy option should you recommend?

An enterprise is designing a data storage solution for a system that generates transactional log blobs in a General-purpose v2 Azure Storage account.

The storage design must meet the following requirements:
* Logs must be accessed frequently and immediately during the first 30 days.
* Between day 31 and day 180, access is infrequent, but any query must return results with sub-second retrieval latency.
* After 180 days, the logs must be retained for a compliance period of 5 years. During this period, retrieval latency of up to 15 hours is acceptable, and storage costs must be minimized.
* The logs must be protected against deletion and modification by all users, including administrators, during the 5-year compliance period.

Which two of the following actions should you include in the design to meet these requirements?

A logistics company is modernizing a web-based vehicle tracking API hosted on a pool of Azure Virtual Machines in a single region. The API requires SSL/TLS termination and URL path-based routing to direct traffic to different backend pools. The virtual machines are currently configured with Basic SKU Public IP addresses for management. You need to recommend a regional load balancing solution that meets these requirements. Which Azure service should you select?

A pharmaceutical company is planning to migrate a proprietary drug-discovery modeling application to Azure. The application has the following requirements:
- The virtual machines must run on hardware dedicated to a single customer at the physical host level to meet compliance standards.
- The workload requires a memory-to-vCPU ratio of at least $8$ GiB of RAM per vCPU.
- The workload is steady-state, runs continuously, and cannot tolerate unexpected eviction or downtime.
- The storage layer requires a single disk that provides $10,000$ IOPS and $200$ MB/s throughput, with the capability to dynamically scale IOPS without resizing the disk.
- The architecture must guarantee a $99.99\%$ VM availability SLA.

Which of the following compute virtualization and storage solutions should you recommend to meet these requirements?

Apex Aerospace is designing a Microsoft Entra ID identity strategy. The organization plans to implement a strict Conditional Access policy that requires Multi-Factor Authentication (MFA) for all administrative roles. The security team wants to ensure that administrators can still access the tenant to resolve configuration issues or during a cloud-based MFA service outage. Which design option should you recommend?

You are designing a global database solution using Azure Cosmos DB. You need to match the specific application requirements on the left to the appropriate Azure Cosmos DB consistency level on the right that meets those requirements with the lowest latency and highest availability.

An Azure Solutions Architect is designing the storage architecture for a global telehealth application. The application must ingest real-time patient health telemetry from 5 million wearable devices distributed globally, with a read/write ratio of $10\%$ reads to $90\%$ writes. The data storage solution must meet a $99.99\%$ availability SLA. Real-time metrics must be stored in Azure Cosmos DB (NoSQL API), while weekly diagnostic report files must be uploaded by the devices directly to Azure Blob Storage. The architecture must satisfy the following requirements:
- Prevent database hot partitions during high-frequency write operations.
- Ensure the weekly diagnostic reports survive a primary datacenter outage.
- Secure device access to the Blob Storage account while minimizing administrative overhead and enabling token revocation.

Which design configuration should you recommend?

NexaHealth is designing an identity and security strategy using Microsoft Entra ID. You need to match each technical requirement to the most appropriate Microsoft Entra ID or Conditional Access feature. Drag the appropriate feature from the column on the right to the matching requirement on the left.

You are designing the compute infrastructure for a mission-critical web application on Azure.

The application consists of two tiers:
- A web frontend tier that must host stateless virtual machines, support automatic horizontal scaling, and guarantee a virtual machine uptime SLA of $99.99\%$.
- A backend transaction processing tier that consists of stateful virtual machines, requires a virtual machine uptime SLA of $99.95\%$, and requires sub-millisecond network latency between the virtual machine instances.

Which two configurations should you recommend? (Select two.)

Veloce Logistics is designing a hybrid identity and security strategy to integrate its on-premises Active Directory Domain Services (AD DS) environment with Microsoft Entra ID. The IT security team has the following requirements:

- Users must be able to sign in to cloud resources using their on-premises credentials.
- If a security incident occurs in the on-premises environment or network connectivity to on-premises is lost, users must still be able to sign in to cloud services without relying on on-premises infrastructure.
- To prevent tenant lockout during a cloud-based multi-factor authentication (MFA) service outage, the security administrator must ensure at least one highly privileged emergency access account can bypass MFA.
- Administrative roles must be managed using Privileged Identity Management (PIM) to prevent persistent administrative privileges.

Which of the following represents the most appropriate combination of hybrid authentication and policy design for Veloce Logistics?