All practice questions

A cloud architect needs to select appropriate Azure networking services to satisfy load balancing and failover requirements for different application types. Match each operational scenario to the optimal Azure service that meets the requirements.

A company is modernizing a web application that will be hosted in a single Azure region. The solution must meet the following requirements:
- Support SSL/TLS termination at the load balancer.
- Support URL path-based routing (HTTP/HTTPS).
- Provide regional zone-redundant high availability.
- Ensure the configuration does not fail validation due to SKU mismatches.

Which load balancing configuration should you recommend?

A healthcare technology provider is designing a SaaS application on Azure that will process patient telemetry data across two different regions: Germany and the United States.

The solution must meet the following requirements:
- Host a containerized processing microservice that scales dynamically based on the queue depth of an Azure Service Bus queue.
- Separate the logging and monitoring data of patient events to comply with strict regional data sovereignty laws in each country.
- Minimize administrative effort and infrastructure management overhead.

Which two components should you include in the design?

A logistics company hosts a legacy portal on-premises on VMware. The application tier consists of three stateless web virtual machines (VMs) with minimal write activity. The data tier consists of a single high-transaction SQL Server VM. The SQL Server VM has a system disk, a data disk averaging $8 \text{ MB/s}$ write churn, and a transaction log disk averaging $32 \text{ MB/s}$ write churn. The company requires a disaster recovery (DR) solution to Azure with a Recovery Point Objective (RPO) of under 10 seconds for the database and under 4 hours for the web tier.

Which disaster recovery design should you recommend?

An enterprise is designing a serverless data processing pipeline in Azure to support a telemetry analysis system. The solution must host the following workloads:

- Workload 1: An event-driven API endpoint that ingests telemetry data. The workload must scale rapidly from $0$ to handle unpredictable traffic spikes, incur $0$ cost when idle, and route outbound traffic through an Azure Virtual Network to securely access a private database.
- Workload 2: A batch processing job that runs containerized custom simulation code triggered by telemetry events. The job must run for up to $45$ minutes per execution and dynamically scale down to $0$ instances when no simulations are active.

The architecture must minimize operational management overhead and monthly hosting costs.

Which two compute solutions should you recommend? (Select two.)

An organization has deployed a virtual network named `vnet-prod-uswest` ($10.110.0.0/16$) that contains two subnets: `subnet-web` ($10.110.1.0/24$) and `subnet-data` ($10.110.2.0/24$). A Network Virtual Appliance (NVA) is deployed in a peered hub virtual network at $10.120.1.4$.

The organization needs to inspect all traffic sent from `subnet-web` to `subnet-data` using the NVA. The solution must ensure that virtual machines within `subnet-web` can still communicate directly with each other without routing through the NVA.

Which route should be added to the route table associated with `subnet-web`?

An organization is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-shared`, has an address space of $10.100.0.0/16$ and contains an Azure VPN Gateway in `GatewaySubnet` ($10.100.0.0/24$) and a Network Virtual Appliance (NVA) at IP address $10.100.10.4$. The spoke virtual network, `vnet-spoke-app`, has an address space of $10.101.0.0/16$. The networks are connected via virtual network peering.

The design must meet the following requirements:
- Spoke virtual machines must route all internet-bound traffic through the NVA in the hub.
- Spoke virtual machines must communicate with an on-premises network ($172.16.0.0/12$) through the VPN Gateway.
- Spoke virtual machines must communicate directly with resources in the hub virtual network ($10.100.0.0/16$) without passing through the NVA.

Which two configurations should you include in the design? (Select two.)

An organization is designing a disaster recovery strategy for a web-based portal hosted in the West Europe and North Europe regions. The solution must support SSL/TLS offloading at the routing layer to reduce decryption overhead on the backend web servers, and it must achieve the lowest possible recovery time objective (RTO) for traffic redirection during a regional failover. Which routing service and configuration should you recommend?

An enterprise is designing a hub-and-spoke network topology in Azure for a multi-tier application. The architecture includes:

* A hub virtual network named `vnet-prod-hub` with an address space of $10.150.0.0/16$.
* `AzureFirewallSubnet` ($10.150.1.0/24$) containing an Azure Firewall with private IP $10.150.1.4$.
* `GatewaySubnet` ($10.150.2.0/24$) containing a Virtual Network Gateway connected to on-premises via ExpressRoute.
* A spoke virtual network named `vnet-prod-spoke` with an address space of $10.160.0.0/16$.
* Subnet `snet-compute` ($10.160.10.0/24$) hosting virtual machines.

The hub and spoke virtual networks are peered. The peering is configured to allow gateway transit on the hub and use remote gateways on the spoke.

The security requirements are:
1. All traffic from `snet-compute` destined for the internet must be routed through the Azure Firewall.
2. All traffic from `snet-compute` destined for the on-premises network ($172.16.0.0/12$) must be routed through the Virtual Network Gateway.
3. All traffic from `snet-compute` destined for the hub virtual network (`vnet-prod-hub`) must be routed through the Azure Firewall for security inspection.

To implement these requirements, a network architect creates a route table named `rt-spoke-routing` with the following user-defined routes (UDRs):
* Route 1: $0.0.0.0/0$ $\rightarrow$ Next hop: Virtual appliance ($10.150.1.4$)
* Route 2: $10.150.0.0/16$ $\rightarrow$ Next hop: Virtual appliance ($10.150.1.4$)

The architect associates `rt-spoke-routing` with the `snet-compute` subnet. To ensure symmetric inspection for return traffic, the architect also associates the same `rt-spoke-routing` route table with the `AzureFirewallSubnet`.

During post-deployment validation, VMs in `snet-compute` can successfully access the internet, but they cannot establish any connections to resources in the hub virtual network, and the Azure Firewall fails to pass traffic to the Gateway Subnet.

Which configuration change should the architect perform to resolve the connectivity issue while satisfying all design requirements?

An administrator needs to configure a Network Security Group (NSG) to allow outbound traffic from an Azure Virtual Network subnet to Azure SQL Database. The IP addresses for Azure SQL Database might change over time. The solution must minimize administrative overhead. Which NSG rule configuration should you recommend?

An enterprise is designing a disaster recovery (DR) solution using Azure Site Recovery (ASR) to replicate workloads from the East US region to the West US region. The target Recovery Point Objective (RPO) is 2 hours, and the Recovery Time Objective (RTO) is 4 hours.

The infrastructure consists of four virtual machines (VMs) using Premium SSD storage. The write churn metrics for each VM are detailed in the table below:

Which of the following virtual machines can be successfully replicated to the target region using the Standard replication tier of Azure Site Recovery?

A logistics company is designing an event-driven system to generate end-of-day shipping manifests. The generation process reads transaction logs, formats reports, and takes between 12 and 18 minutes to complete per run. The process is triggered by a scheduler message in an Azure Service Bus queue. The company requires a compute solution that minimizes operational overhead and incurs costs only when executing. Which compute option should you recommend?

A financial firm is designing a secure network environment for a pool of virtual machines in a virtual network subnet named Subnet1. The design must meet the following requirements:
- The virtual machines must retrieve cryptographic keys from an Azure Key Vault.
- The virtual machines must be isolated behind a load balancer that distributes incoming traffic.
- All outbound traffic to the internet must be blocked except for connections to Azure Key Vault.
- The configuration must minimize administrative maintenance.

Which security and load balancing configuration should you recommend?

An organization is designing a high-availability solution for an enterprise web application deployed across the East US and West US regions. The design must meet the following requirements:
- Web traffic must be routed to the closest region to minimize latency for users.
- Secure Sockets Layer (SSL) termination must be handled at the global entry point to offload cryptographic processing from the backend servers.
- The solution must support URL path-based routing to direct traffic for `/static/*` and `/api/*` to different backend pools.
- Health monitoring must detect a regional outage and failover traffic within 30 seconds.

Which two actions should you include in the design to meet these requirements?

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` ($10.100.0.0/16$), contains an ExpressRoute Gateway in `GatewaySubnet`, an Azure Route Server in `RouteServerSubnet` ($10.100.1.0/24$), and a pair of active-passive Network Virtual Appliances (NVAs) in `NvaSubnet` ($10.100.2.0/24$). The spoke virtual network, `vnet-weur-spoke-prod` ($10.101.0.0/16$), is peered directly with the hub.

To implement security inspection, all egress traffic to the internet ($0.0.0.0/0$) from both the spoke and the hub must be routed through the NVA ($10.100.2.4$). The NVA advertises the $0.0.0.0/0$ route to the Azure Route Server via BGP.

Which two configurations must you implement to ensure routing functions correctly without routing loops or unsupported configurations?

An organization is designing a secure network architecture in Azure. The design includes:
- A subnet named Subnet-App hosting virtual machines that run an application.
- An Azure Key Vault that stores cryptographic keys.
- A Private Endpoint for the Key Vault deployed in a subnet named Subnet-Private with a private IP address of 10.10.2.4.

A Network Security Group (NSG) associated with Subnet-App must allow the virtual machines to access the Key Vault via the Private Endpoint. To meet security compliance, you must block all other outbound traffic from Subnet-App to both the internet and other resources within the virtual network.

Which configuration should you specify for the destination in the NSG outbound security rule on Subnet-App to meet the requirements with the least administrative effort?

A media broadcasting company stores high-resolution raw video footage in a General-purpose v2 (GPv2) Azure Blob storage account. The data access patterns and requirements are as follows:

* Newly uploaded footage is frequently accessed and edited for the first 30 days.
* Between 30 and 90 days, the footage is rarely accessed but must be available for immediate playback (sub-second retrieval latency) if requested by editors.
* After 90 days, the footage is preserved for long-term compliance for a total of 365 days from the upload date. For compliance audits, retrieval latency of up to 15 hours is acceptable.
* After 365 days, the footage must be permanently deleted.

Which of the following lifecycle management configurations meets the requirements while minimizing storage costs?

An enterprise is designing a multi-tier application in an Azure virtual network named VNet1. The application consists of web servers, application servers, and database servers.

You need to design a network security strategy using Network Security Groups (NSGs) to isolate the traffic between these tiers. The strategy must meet the following requirements:
- Allow web servers to communicate only with the application servers.
- Allow application servers to communicate only with the database servers.
- Minimize administrative effort as virtual machines (VMs) are added or removed from each tier.
- Avoid the use of individual IP addresses in the security rules.

Which two actions should you include in the design?

You are planning to migrate several physical on-premises application servers to Azure. To prevent application downtime and network latency issues post-migration, you need to identify which servers have active network connections with each other so that they can be migrated in the same group. Which Azure Migrate feature should you use to map these server relationships?

An organization is designing an event-driven system to process data files uploaded to Azure Blob Storage. The file sizes range from $10$ MB to $500$ MB, and the processing time for a single file can take up to $15$ minutes to complete. The system must process files as they are uploaded, scale down to zero instances when no files are present to minimize costs, and require the lowest possible administrative overhead. Which Azure compute solution should you recommend?