All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

An organization is designing a disaster recovery (DR) solution from the East US region to the West US region for a database workload hosted on an Azure virtual machine named VM2. The disaster recovery requirements specify a Recovery Point Objective (RPO) of $15$ minutes and a Recovery Time Objective (RTO) of $1$ hour.

VM2 is configured with three Premium SSD v1 disks as detailed in the following table:

Disk	Content	Write Churn
Disk 1	Operating System	$2\text{ MB/s}$
Disk 2	User Databases	$12\text{ MB/s}$
Disk 3	TempDB	$25\text{ MB/s}$

Which two actions should you include in the Azure Site Recovery (ASR) design to ensure replication is successful and meets the workload requirements?

Select all that apply

Configure Azure Site Recovery to exclude the TempDB disk (Disk 3) from replication.

Configure the replication policy for VM2 to use the High Churn tier.

Replicate all three disks using the default standard replication policy.

Replicate Disk 3 by changing its storage tier to Standard HDD.

Show answer & explanation

Answer: Configure Azure Site Recovery to exclude the TempDB disk (Disk 3) from replication.; Configure the replication policy for VM2 to use the High Churn tier.

Answer

To design a successful replication strategy using Azure Site Recovery, you must configure Azure Site Recovery to exclude the TempDB disk (Disk 3) from replication and configure the replication policy for the virtual machine to use the High Churn tier.

Excluding the TempDB disk (Disk 3) from replication is the correct approach because TempDB contains temporary data that is recreated when SQL Server starts, and its write churn of

25\text{ MB/s}

exceeds the maximum supported limit (

20\text{ MB/s}

) for Azure Site Recovery. Enabling the High Churn replication policy is also required because Disk 2 has a write churn of

12\text{ MB/s}

, which exceeds the standard limit of

10\text{ MB/s}

but is supported under the High Churn policy tier.

Step-by-Step Solution

Analyze the write churn for each disk against Azure Site Recovery limits.

Disk 1 (

2\text{ MB/s}

) is within standard limits. Disk 2 (

12\text{ MB/s}

) exceeds the standard limit of

10\text{ MB/s}

but is within the high churn limit of

20\text{ MB/s}

. Disk 3 (

25\text{ MB/s}

) exceeds the high churn limit of

20\text{ MB/s}

This identifies which disks require special handling or policies due to exceeding replication thresholds.

Determine if any disk contents can be excluded from replication.

Disk 3 contains TempDB, which is non-persistent and recreated when the SQL Server service starts on the failover VM.

Excluding TempDB reduces replication bandwidth and removes a disk that violates the absolute ASR write churn limits.

Select the appropriate replication policy for the remaining disks.

Since Disk 2 has a churn rate of

12\text{ MB/s}

(exceeding standard limits), configuring the replication policy to use the High Churn tier is necessary to successfully replicate the VM.

Assigning the High Churn policy ensures that Disk 2 can replicate to the target region without failing due to rate limits.

Key Concept

Azure Site Recovery VM replication limits, High Churn policy support, and disk exclusion strategies for temporary data workloads.

Question 1022Question →

A media streaming company is designing a serverless video processing and distribution portal. The architecture requires two workloads:

* User portal frontend: A static single-page application (SPA) that must be globally distributed with minimal latency, SSL termination, and custom domain support.
* Video encoding microservice: A containerized workload that processes uploaded video files. The encoding job takes $15$ to $20$ minutes to run per video, and compute resources must only be active during the encoding process to avoid baseline idle charges.

Which two Azure hosting solutions should you recommend to meet these requirements? (Choose two.)

Select all that apply

Azure Static Web Apps for the user portal frontend

Azure Container Apps jobs for the video encoding microservice

Azure Functions on a Consumption plan for the video encoding microservice

An Azure Kubernetes Service (AKS) cluster to host the video encoding microservice and the user portal frontend

Show answer & explanation

Answer: Azure Static Web Apps for the user portal frontend; Azure Container Apps jobs for the video encoding microservice

Answer

The correct architecture recommends Azure Static Web Apps for the user portal frontend and Azure Container Apps jobs for the video encoding microservice.

The combination of Azure Static Web Apps and Azure Container Apps jobs meets all functional, non-functional, and operational requirements. Azure Static Web Apps provides a globally optimized, managed hosting environment for the static frontend. Azure Container Apps jobs host the long-running, containerized video encoding workload on-demand and scale to zero after completion, avoiding idle costs.

Step-by-Step Solution

Analyze the requirements for the user portal frontend, noting it is a static single-page application requiring global distribution, custom domains, and SSL.

Identify Azure Static Web Apps as the ideal choice because it natively provides global hosting via a content delivery network (CDN), automated SSL provisioning, and zero administrative overhead.

This minimizes operational costs and complexity compared to hosting static files on virtual machines, containers, or full App Service plans.

Analyze the video encoding microservice requirements, noting it is a containerized, run-to-completion task that runs for

15

20

minutes and must scale to zero when inactive.

Rule out Azure Functions on a standard Consumption plan due to its

10

-minute maximum execution limit.

Avoiding execution timeouts is a critical constraint for long-running batch processing workloads.

Evaluate hosting alternatives for the containerized workload to minimize operational overhead.

Select Azure Container Apps jobs over Azure Kubernetes Service (AKS) for the video encoding microservice.

Azure Container Apps jobs scale dynamically, scale to zero when not running, and avoid the complex orchestration overhead and infrastructure baseline costs associated with AKS.

Key Concept

Selecting appropriate Azure hosting solutions based on execution limits, container support, deployment complexity, and cost-efficiency requirements.

Question 1023Question →

A software developer is configuring lifecycle management rules for a General-purpose v2 (GPv2) Azure Blob Storage account that collects IoT telemetry data from manufacturing plants. The retention and access requirements are as follows:
- The telemetry data must support sub-second query response times for the first 30 days after upload.
- Between 31 and 180 days after upload, the data is rarely queried but must still be retrievable with sub-second latency.
- After 180 days, the data must be preserved for 7 years (2,555 days) to comply with industrial regulations. During this compliance period, a retrieval delay of up to 15 hours is acceptable.
- Storage costs must be minimized.

Which lifecycle management policy configuration should you recommend?

Transition the blobs to the Cool tier 30 days after creation, transition to the Archive tier 180 days after creation, and delete the blobs 2,555 days after creation.

Transition the blobs to the Archive tier 30 days after creation, transition to the Cool tier 180 days after creation, and delete the blobs 2,555 days after creation.

Transition the blobs to the Archive tier 30 days after creation, and delete the blobs 2,555 days after creation.

Transition the blobs to the Archive tier 1 day after creation, transition to the Cool tier 30 days after creation, and delete the blobs 2,555 days after creation.

Show answer & explanation

Answer: Transition the blobs to the Cool tier 30 days after creation, transition to the Archive tier 180 days after creation, and delete the blobs 2,555 days after creation.

Answer

Transition the blobs to the Cool tier 30 days after creation, transition to the Archive tier 180 days after creation, and delete the blobs 2,555 days after creation.

The correct configuration transitions the blobs to the Cool tier after 30 days to reduce storage costs while maintaining sub-second retrieval latency, transitions them to the Archive tier after 180 days when a retrieval delay of up to 15 hours is acceptable, and finally deletes them after 2,555 days to comply with the 7-year retention policy. This minimizes storage costs without violating any retrieval latency requirements.

Step-by-Step Solution

Determine the storage tier required for the first 30 days.

Keep in the Hot tier (default) to support sub-second query analysis.

The initial 30 days require sub-second access for active analysis, which is provided by the Hot tier.

Select the storage tier for days 31 to 180.

Transition to the Cool tier 30 days after creation.

The Cool tier offers lower storage costs than the Hot tier while still providing the required sub-second retrieval latency for queries during this period of lower access frequency.

Select the storage tier and retention actions for data older than 180 days.

Transition to the Archive tier 180 days after creation, and delete after 2,555 days.

Since a retrieval delay of up to 15 hours is acceptable after 180 days, the data can be moved to the highly cost-effective Archive tier (which has a rehydration time of hours). It must be kept for the remainder of the 7 years (2,555 days) and then deleted to minimize ongoing costs.

Key Concept

Selecting appropriate storage tiers in Azure lifecycle management policies based on retrieval latency requirements and minimizing overall costs.

Question 1024Question →

An enterprise is designing a regional load balancing and traffic delivery solution in Azure. The design must satisfy the following requirements:
1. Incoming public HTTP/S traffic must be routed based on the URL path: requests to `/search/*` must be forwarded to a Virtual Machine Scale Set, while requests to `/checkout/*` must be forwarded to a group of Dedicated Hosts.
2. SSL/TLS termination must be performed at the application routing boundary to decrypt traffic before reaching the backend VMs.
3. Internal database replication traffic on TCP port 6379 must be load-balanced across database virtual machines distributed across multiple Availability Zones for high availability.
4. The database virtual machines are currently configured with Basic SKU Public IP addresses for legacy remote access.

Which configuration should you select to satisfy all requirements and ensure successful deployment validation?

Deploy an Azure Application Gateway for the HTTP/S traffic, and deploy a Standard Azure Load Balancer for the internal TCP traffic after upgrading the database virtual machines' Public IPs to the Standard SKU.

Deploy an Azure Traffic Manager for the HTTP/S traffic, and deploy a Standard Azure Load Balancer for the internal TCP traffic while keeping the database virtual machines' Public IPs on the Basic SKU.

Deploy an Azure Application Gateway for the HTTP/S traffic, and deploy a Basic Azure Load Balancer for the internal TCP traffic to maintain compatibility with the database virtual machines' Basic SKU Public IPs.

Deploy an Azure Front Door for the HTTP/S traffic, and deploy a Standard Azure Load Balancer for the internal TCP traffic while keeping the database virtual machines' Public IPs on the Basic SKU.

Show answer & explanation

Answer: Deploy an Azure Application Gateway for the HTTP/S traffic, and deploy a Standard Azure Load Balancer for the internal TCP traffic after upgrading the database virtual machines' Public IPs to the Standard SKU.

Answer

The correct configuration uses Azure Application Gateway for regional Layer 7 routing and SSL/TLS termination, combined with a Standard Azure Load Balancer to distribute internal database replication traffic across Availability Zones. To resolve the SKU mismatch validation error, the database virtual machines' Public IP addresses must be upgraded to the Standard SKU because Standard Load Balancer backend pools do not support virtual machines associated with Basic SKU Public IPs.

Step-by-Step Solution

Evaluate HTTP/S routing and decryption requirements.

The requirements for path-based routing (/search/* and /checkout/*) and SSL/TLS termination at the boundary dictate a Layer 7 load balancer. For regional workloads, Azure Application Gateway is the correct resource choice.

Layer 4 load balancers cannot inspect HTTP paths or terminate SSL sessions, and Azure Traffic Manager operates purely at the DNS level.

Evaluate internal database TCP load balancing and Availability Zone requirements.

The requirements specify load balancing of TCP port 6379 across Availability Zones. This requires a Standard Azure Load Balancer.

The Basic SKU Azure Load Balancer does not support Availability Zones, making the Standard SKU mandatory to fulfill the high availability requirement.

Address the deployment validation failure due to SKU mismatch.

Identify that the database virtual machines have Basic SKU Public IPs, which cannot coexist with a Standard Load Balancer's backend pool. The public IPs must be upgraded to the Standard SKU.

Azure prevents the mixing of Basic and Standard SKUs on resources connected to the same virtual machine network interfaces associated with a Load Balancer backend pool.

Key Concept

Integrating Azure Application Gateway and Standard Load Balancer while avoiding SKU mismatch validation errors

Question 1025Question →

A retail company stores customer invoice PDF documents in a General-purpose v2 (GPv2) Azure Blob storage account. The documents must be managed according to the following requirements:

* Invoices must be immediately available for active customer support queries during the first 30 days after creation.
* Between 31 and 180 days after creation, invoices are rarely accessed but must still support immediate, sub-second retrieval.
* After 180 days, invoices must be retained for an additional 1,095 days to meet regulatory compliance audits. Retrieval latency of several hours is acceptable during this period.
* After the retention period, the invoices must be permanently deleted to minimize storage costs.

You need to design a lifecycle management policy to meet these requirements while minimizing costs.

Which two actions should you include in the lifecycle management policy? (Select two.)

Select all that apply

Transition the blobs to the Cool tier 30 days after creation.

Transition the blobs to the Archive tier 180 days after creation.

Transition the blobs to the Archive tier 30 days after creation.

Delete the blobs 1,095 days after creation.

Delete the blobs 180 days after creation.

Show answer & explanation

Answer: Transition the blobs to the Cool tier 30 days after creation.; Transition the blobs to the Archive tier 180 days after creation.

Answer

Transition the blobs to the Cool tier 30 days after creation, and transition the blobs to the Archive tier 180 days after creation.

The correct configurations are transitioning the blobs to the Cool tier after 30 days and transitioning them to the Archive tier after 180 days. The Cool tier allows sub-second retrieval which satisfies the requirement for the 31-180 days period. The Archive tier is the most cost-effective tier for the subsequent 1,095-day compliance period since retrieval latency of several hours is acceptable.

Step-by-Step Solution

Analyze the access and retrieval latency requirements for each phase of the data lifecycle.

The first 30 days require Hot storage. Days 31 to 180 require storage that supports sub-second latency (Cool storage is appropriate). Days 181 to 1,275 require cost-optimized storage where high latency is acceptable (Archive storage).

To map requirements to the correct Azure Storage tiers without violating performance or latency SLA constraints.

Calculate the timing for the lifecycle rule transitions based on days elapsed since creation.

Transition to Cool tier occurs 30 days after creation. Transition to Archive tier occurs 180 days after creation. Deletion occurs after

180 + 1095 = 1275

days.

Lifecycle policy rules evaluate conditions based on elapsed days since creation or modification.

Identify the incorrect actions by evaluating against latency constraints and duration calculations.

Transitioning to Archive at 30 days violates the sub-second retrieval latency between 31 and 180 days. Deletion at 180 or 1,095 days violates the required retention duration.

To filter out distractors that introduce retrieval latency issues or fail compliance retention times.

Key Concept

Configuring Azure Blob Storage lifecycle management rules to balance storage costs, retrieval latency constraints, and data retention compliance.

Estimated Time:1m 30s

Question 1026Question →

A company is planning to restrict outbound network traffic from an Azure Virtual Network subnet named Subnet1. The virtual machines in Subnet1 must be allowed to send metric and log data to Azure Monitor, but all other outbound internet traffic must be blocked. You need to design a Network Security Group (NSG) rule configuration for Subnet1 that permits this traffic while minimizing administrative effort and avoiding manual rule updates when Azure Monitor IP addresses change. Which rule configuration should you recommend?

A design that deploys a separate Log Analytics workspace in every region to isolate traffic, bypassing NSG controls entirely

Outbound security rules with the destination set to the individual public IP address ranges of the Azure Monitor endpoints

An outbound security rule with the destination set to the AzureMonitor Service Tag

A User Defined Route with a destination of 0.0.0.0/0 pointing to a virtual appliance, along with overlapping routes for each Azure Monitor public IP address

Show answer & explanation

Answer: An outbound security rule with the destination set to the AzureMonitor Service Tag

Answer

An outbound security rule with the destination set to the AzureMonitor Service Tag

The correct answer recommends using the AzureMonitor Service Tag in the outbound NSG rule. Service Tags represent a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, thereby minimizing the administrative effort of managing security rules.

Step-by-Step Solution

Identify the target service destination for outbound traffic from the virtual network subnet.

The destination is Azure Monitor (including Log Analytics and Application Insights).

The requirement states that virtual machines must be permitted to send metrics and logs to Azure Monitor.

Select a mechanism in Network Security Groups (NSGs) that represents group IP address prefixes from a specific Azure service.

The AzureMonitor Service Tag is identified as the built-in system tag representing these IP address ranges.

Service Tags simplify NSG rule creation and are automatically managed and updated by Microsoft.

Evaluate the options against the constraint to minimize administrative effort and avoid manual rule updates.

Configuring the outbound NSG rule to use the AzureMonitor Service Tag meets all requirements, while manual IP configuration or complex routing overrides introduce administrative overhead and failure risks.

This provides the most operationally efficient and robust network security configuration.

Key Concept

Azure Service Tags simplify NSG management by letting you reference groups of IP address prefixes for specific Azure services.

Question 1027Question →

An organization plans to migrate several on-premises Hyper-V virtual machines to Azure. You need to use Azure Migrate to perform a migration assessment, determine VM readiness, and estimate monthly costs. Which two initial tasks must you perform to complete this assessment? (Choose two.)

Select all that apply

Create an Azure Migrate project and deploy the Azure Migrate appliance in the on-premises Hyper-V environment to discover metadata.

Create an Azure Migrate assessment in the project using the discovered server metadata.

Deploy Microsoft Entra Connect and configure Active Directory Federation Services (AD FS) on the workloads.

Migrate all databases to Azure SQL Database single databases before analyzing database compatibility.

Replicate the workloads to Azure immediately without running any dependency analysis.

Show answer & explanation

Answer: Create an Azure Migrate project and deploy the Azure Migrate appliance in the on-premises Hyper-V environment to discover metadata.; Create an Azure Migrate assessment in the project using the discovered server metadata.

Answer

The two correct tasks are creating an Azure Migrate project and deploying the Azure Migrate appliance to discover metadata, and creating an Azure Migrate assessment using the discovered server metadata.

Evaluating on-premises Hyper-V virtual machines using Azure Migrate requires establishing a project, deploying a discovery appliance on-premises to collect configuration/performance data, and then generating an assessment. Creating the project and appliance ensures metadata is collected, and configuring the assessment calculates the cost estimates and VM readiness.

Step-by-Step Solution

Set up the Azure Migrate project and discover on-premises infrastructure.

An Azure Migrate project is created, and the Azure Migrate appliance is deployed in the Hyper-V environment to collect metadata.

This establishes the framework and collects the configuration data required for assessment.

Run the assessment tool on the discovered metadata.

The assessment calculates Azure readiness, sizing recommendations, and monthly costs.

This provides the required readiness and cost estimation outputs.

Key Concept

Azure Migrate discovery and assessment workflow

Question 1028Question →

An enterprise is designing a hub-and-spoke network topology in Azure with the following resource configurations:

* Hub VNet (`vnet-hub-weur`): Address space $10.200.0.0/16$ . Contains an Azure VPN Gateway in the `GatewaySubnet` and a Network Virtual Appliance (NVA) at IP $10.200.1.4$ in `subnet-nva`.
* Spoke A VNet (`vnet-prod-weur`): Address space $10.201.0.0/16$ . Contains application servers in `subnet-app` ( $10.201.1.0/24$ ).
* Spoke B VNet (`vnet-shared-weur`): Address space $10.202.0.0/16$ . Contains shared services in `subnet-data` ( $10.202.1.0/24$ ).

Virtual network peering is established between `vnet-prod-weur` and `vnet-hub-weur`, and between `vnet-shared-weur` and `vnet-hub-weur`. There is no direct peering between the two spokes.

A route table named `rt-prod-app` is associated with `subnet-app` and has the following User Defined Routes (UDRs) configured:
* Destination: $0.0.0.0/0$ , Next hop: Virtual appliance ( $10.200.1.4$ )
* Destination: $10.0.0.0/8$ , Next hop: Virtual network gateway

The on-premises network uses the address space $10.0.0.0/8$ . All traffic from `subnet-app` to Spoke B must go through the NVA for inspection. During testing, administrators observe that servers in `subnet-app` can reach the internet and on-premises resources, but cannot communicate with `subnet-data` in Spoke B.

Which of the following routing configurations will resolve the connectivity issue to Spoke B while maintaining all other security and routing requirements?

Add a route to `rt-prod-app` with the destination

10.202.0.0/16

and the next hop set to the Virtual appliance (

10.200.1.4

Change the next hop of the

10.0.0.0/8

route in `rt-prod-app` to the Virtual appliance (

10.200.1.4

Add a route to `rt-prod-app` with the destination

10.200.0.0/16

and the next hop set to the Virtual appliance (

10.200.1.4

Enable gateway transit on the peering connection between `vnet-hub-weur` and `vnet-prod-weur` and configure the spoke peering to use the remote virtual network's gateway.

Show answer & explanation

Answer: Add a route to `rt-prod-app` with the destination $10.202.0.0/16$ and the next hop set to the Virtual appliance ( $10.200.1.4$ ).

Answer

Add a route to the route table with the destination of the Spoke B address space (

10.202.0.0/16

) and the next hop set to the Virtual appliance (

10.200.1.4

Adding a route for the Spoke B address space (

10.202.0.0/16

) with the next hop set to the NVA (

10.200.1.4

) resolves the issue. Because Azure uses the Longest Prefix Match (LPM) algorithm, the more specific

/16

route for Spoke B takes precedence over the broader

10.0.0.0/8

route (which points to the Virtual network gateway). This ensures that traffic destined for Spoke B is routed through the NVA for security inspection, while traffic to on-premises (

10.0.0.0/8

excluding the Spoke B range) still goes to the Virtual network gateway.

Step-by-Step Solution

Analyze the destination IP space for Spoke B traffic.

The destination address space for Spoke B is

10.202.0.0/16

We need to understand what IP ranges are matched when a packet is sent to Spoke B.

Evaluate the routing table rules using the Longest Prefix Match (LPM) algorithm.

The destination

10.202.x.x

matches both

0.0.0.0/0

and

10.0.0.0/8

. Since

10.0.0.0/8

is a longer prefix match than

0.0.0.0/0

(8 bits vs 0 bits), Azure routes this traffic to the Virtual network gateway.

This explains why the traffic is currently failing to reach the NVA.

Determine if any system routes override this behavior.

No system route exists for

10.202.0.0/16

because VNet peering is non-transitive. The only system routes are for the local VNet (

10.201.0.0/16

) and the directly peered Hub VNet (

10.200.0.0/16

Confirming that Azure does not automatically insert a route for indirect spokes.

Formulate a more specific UDR to redirect the traffic to the NVA.

Add a route for

10.202.0.0/16

pointing to the NVA (

10.200.1.4

). This

/16

route is more specific than the

/8

route, ensuring Spoke B traffic is sent to the NVA, while on-premises traffic (matching the rest of

10.0.0.0/8

) still goes to the gateway.

This solves the problem by overriding the broad UDR for Spoke B destinations only.

Key Concept

Azure routing precedence and Longest Prefix Match (LPM) in a hub-and-spoke topology.

Alternative Method

Instead of adding a static UDR for the entire Spoke B range, you could also configure Azure Route Server in the Hub VNet to dynamically exchange routes between the NVA and the spoke VNets, provided the NVA supports BGP and is configured to advertise the Spoke B prefix to Route Server.

Estimated Time:2m 0s

Question 1029Question →

An organization is designing a high-availability and disaster recovery architecture for various workloads deployed in Azure. You need to select the appropriate load balancing and traffic routing services. Match each application routing requirement with the optimal Azure service.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Route global HTTPS traffic with path-based routing matches Azure Front Door; Load balance global TCP traffic using Anycast matches Azure Cross-region Load Balancer; Distribute regional HTTP(S) traffic with path-based rules matches Azure Application Gateway; Load balance global TCP/UDP endpoints using DNS matches Azure Traffic Manager.

The correct pairings are determined by matching the geographic scope (global vs. regional), the OSI layer (layer 4 TCP/UDP vs. layer 7 HTTP/S), and the routing mechanism (Anycast vs. DNS-based) of the requirements with the respective features of Azure Front Door, Azure Cross-region Load Balancer, Azure Application Gateway, and Azure Traffic Manager.

Step-by-Step Solution

Identify the geographical scope (global vs. regional) and network layer (layer 4 vs. layer 7) for each requirement.

Two requirements specify global HTTP(S) routing, one specifies global non-HTTP TCP/UDP routing, and one specifies regional HTTP(S) routing.

This helps categorize and filter the available Azure load balancing services.

Distinguish between the global services: Azure Front Door, Azure Traffic Manager, and Azure Cross-region Load Balancer.

Azure Front Door matches global layer 7 (HTTP/S) Anycast routing. Azure Traffic Manager matches DNS-based routing for generic endpoints. Azure Cross-region Load Balancer matches global layer 4 Anycast routing.

This pairs the global requirements with their corresponding services based on the routing mechanism and protocol requirements.

Identify the regional service matching the regional HTTP(S) requirement.

Azure Application Gateway is the regional layer 7 service that supports cookie-based affinity and path-based routing.

This resolves the final requirement by matching it to the regional application delivery controller.

Key Concept

Selecting the appropriate Azure load balancing and traffic routing services based on application protocol (HTTP/S vs. TCP/UDP), routing layer (Layer 4 vs. Layer 7), and geographic scope (Global vs. Regional).

Estimated Time:2m 0s

Question 1030Question →

A multinational enterprise is designing a high-availability infrastructure in Azure for a new online banking application. The design must meet the following requirements:
- Global client requests must be routed based on the URL path (e.g., /payments to Region 1 and /accounts to Region 2).
- SSL/TLS termination must be performed at the global routing edge to reduce latency.
- Within each region, HTTP(S) traffic must be distributed across a pool of virtual machines with session affinity.
- A legacy batch processing component in Region 1 must receive TCP-based traffic on port 8088 distributed via an Azure Load Balancer. The existing virtual machines for this component are currently assigned Basic SKU public IP addresses.

Which two configuration decisions must you include in the network architecture design to satisfy these requirements? (Select TWO).

Select all that apply

Provision Azure Front Door to handle the global path-based routing and SSL/TLS termination at the edge.

Upgrade the public IP addresses of the legacy batch processing virtual machines to Standard SKU before adding them to a Standard Load Balancer backend pool.

Provision Azure Traffic Manager to perform SSL/TLS termination and route client requests based on the URL path.

Deploy a Standard Azure Load Balancer and directly associate the existing legacy virtual machines using their Basic SKU public IP addresses.

Show answer & explanation

Answer: Provision Azure Front Door to handle the global path-based routing and SSL/TLS termination at the edge.; Upgrade the public IP addresses of the legacy batch processing virtual machines to Standard SKU before adding them to a Standard Load Balancer backend pool.

Answer

Provision Azure Front Door for global routing and SSL termination, and upgrade the legacy virtual machines' public IP addresses to Standard SKU before adding them to a Standard Load Balancer backend pool.

To satisfy the global Layer 7 routing and SSL/TLS termination requirements, Azure Front Door must be used. To support the regional TCP-based batch processing component using a Standard Load Balancer, the public IP addresses of the legacy virtual machines must be upgraded to Standard SKU to ensure compatibility.

Step-by-Step Solution

Analyze global routing and SSL/TLS requirements.

Identify that the system requires Layer 7 path-based routing and SSL/TLS termination at the global level.

Azure Front Door operates at Layer 7 and is the correct choice, whereas Traffic Manager is a DNS-based Layer 4 load balancer.

Analyze regional TCP load balancing requirements and legacy VM configuration.

Identify that legacy virtual machines have Basic SKU public IP addresses and need to be placed behind a Standard Azure Load Balancer.

Standard Azure Load Balancer requires all associated VM network interfaces and public IP addresses to use the Standard SKU.

Formulate remediation for the legacy VM public IP addresses.

Determine that the legacy VMs' public IP addresses must be upgraded to Standard SKU.

This avoids the SKU mismatch validation error (err_az305_core_infra_network_lb_sku_mismatch).

Key Concept

Selecting appropriate global and regional load balancing services while maintaining SKU compatibility across resources.

Estimated Time:3m 0s

Question 1031Question →

A company named CloudFlux is designing a secure network environment for a hybrid application. You have an Azure virtual network named VNet1 containing a subnet named Subnet1. Subnet1 hosts several virtual machines that run a business-critical application. The application needs to retrieve connection strings and credentials from an Azure Key Vault named KV1.

You need to design a network security solution that meets the following requirements:
- Access to KV1 from the virtual machines must not traverse the public internet.
- The virtual machines must not have public IP addresses.
- Azure administrators must be able to securely manage the virtual machines using the Azure portal over SSL without exposing RDP or SSH ports directly to the public internet.

Which two components should you include in the design? (Select two.)

Select all that apply

A Private Endpoint for KV1 associated with Subnet1

An Azure Bastion host deployed to a dedicated subnet in VNet1

A Network Security Group (NSG) rule for Subnet1 configured to allow outbound traffic to a custom list of manually resolved IP addresses for KV1

A route table containing a User-Defined Route (UDR) that overrides the default VNet system route to force all Key Vault traffic to the public internet

Show answer & explanation

Answer: A Private Endpoint for KV1 associated with Subnet1; An Azure Bastion host deployed to a dedicated subnet in VNet1

Answer

The correct components are a Private Endpoint for the Key Vault to establish private connectivity within the virtual network, and an Azure Bastion host to allow secure, agentless administrative management over SSL without public IP exposure.

Deploying a Private Endpoint assigns a private IP address from the virtual network subnet to the Key Vault, satisfying the requirement to keep traffic off the public internet. Azure Bastion provides secure RDP and SSH access over SSL directly from the Azure portal to the virtual machines without requiring public IP addresses on the target VMs.

Step-by-Step Solution

Analyze the requirement for secure, private access to Azure Key Vault (KV1) without traversing the public internet.

Determine that a Private Endpoint integrates the service into the virtual network with a private IP address, satisfying this constraint.

Private Endpoints ensure traffic to PaaS resources stays within the Microsoft backbone network.

Analyze the requirement to securely manage virtual machines without public IPs or public-facing management ports.

Identify that Azure Bastion provides secure SSL-based RDP/SSH access directly from the Azure portal over a private IP.

Azure Bastion eliminates the need to expose VMs to the public internet for administrative access.

Evaluate the distractors against the requirements and Azure best practices.

Determine that manual IP configurations in NSGs and overriding system routes via UDRs to force public routing are administrative anti-patterns and violate security constraints.

Azure service IPs change frequently, making manual NSG rules brittle, and UDR public routing violates the private access requirement.

Key Concept

Designing secure, private access to Azure PaaS resources using Private Endpoints and secure management access using Azure Bastion.

Estimated Time:2m 0s

Question 1032Question →

An insurance company is designing a serverless microservices-based application. The application consists of four containerized services: an API gateway, a customer profile service, a claim intake portal, and a background report generation service that processes heavy PDF claims. The report generation service can take up to 15 minutes to complete a single processing job. The hosting platform must support scaling to zero to minimize costs during idle periods, require minimal infrastructure management overhead, and allow secure internal communication between the containerized services.

Which hosting solution should you design?

Azure Kubernetes Service (AKS)

Azure Container Apps

Azure Functions on a Consumption plan

Azure Virtual Machine Scale Sets using Spot VMs

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps

Azure Container Apps is the ideal hosting solution because it is designed for microservices, supports scaling to zero to eliminate idle costs, provides secure service-to-service communication, and has minimal operational management overhead. Additionally, it has no execution timeout limit that would restrict the 15-minute report generation service.

Step-by-Step Solution

Analyze the hosting requirements for the containerized microservices.

The solution must support four containerized services, allow secure internal communication, scale to zero to minimize idle costs, and run a report generation service that executes for up to 15 minutes.

Establishing the functional and non-functional constraints ensures the selected platform meets all business and technical needs.

Evaluate the execution time constraint against the candidate serverless platforms.

Azure Functions on a Consumption plan has a maximum execution timeout of 10 minutes, making it unsuitable for the 15-minute report generation service.

Eliminating options with hard execution limits prevents timeout-related failures in the production system.

Evaluate the cost and management overhead constraints.

Azure Kubernetes Service (AKS) introduces high cluster management and operational overhead, and does not natively scale to zero without complex auto-scaling configurations. Spot VMs on Virtual Machine Scale Sets are subject to eviction, making them unsuitable for steady-state production services. Azure Container Apps meets all criteria: it scales to zero, supports long-running containerized workloads, provides secure internal networking, and requires minimal management overhead.

Selecting a managed serverless container service minimizes administrative overhead while optimizing costs during periods of inactivity.

Key Concept

Selecting the appropriate serverless or container hosting platform based on execution time limits, cost requirements, and operational overhead.

Question 1033Question →

A financial services company hosts a critical web API across two Azure regions: East US and West Europe. The API requires SSL offloading, URL path-based routing to direct requests (such as routing /payments to a dedicated backend pool), and a global failover mechanism that achieves a recovery time objective (RTO) of less than one minute. Which traffic routing solution should you recommend?

Deploy Azure Front Door to route global traffic, configure path-based routing rules, and perform SSL offloading.

Deploy Azure Traffic Manager to manage global traffic routing, and configure path-based routing and SSL offloading directly on the Traffic Manager profile.

Deploy Azure Application Gateway in a multi-region configuration to route traffic globally, configure path-based routing rules, and perform SSL offloading.

Deploy Azure Traffic Manager to route traffic globally, and deploy Azure Load Balancer in each region to perform path-based routing and SSL offloading.

Show answer & explanation

Answer: Deploy Azure Front Door to route global traffic, configure path-based routing rules, and perform SSL offloading.

Answer

Deploy Azure Front Door to route global traffic, configure path-based routing rules, and perform SSL offloading.

The correct option is the one proposing Azure Front Door. Azure Front Door is an Anycast-enabled global Layer 7 load balancer. It natively supports SSL/TLS termination, URL path-based routing, and rapid backend health monitoring that enables failover in less than a minute.

Step-by-Step Solution

Analyze the layer routing requirements.

The requirements specify SSL offloading and URL path-based routing (e.g., /payments), which are Layer 7 (application layer) features.

This rules out Layer 4 load balancing solutions and DNS-only solutions at the entry point unless chained, though a unified global solution is preferred.

Evaluate the global failover and RTO requirements.

The RTO must be less than one minute. DNS-based solutions like Traffic Manager rely on client DNS caching and TTL, which can delay failover times beyond one minute for many clients.

Anycast-based routing (used by Azure Front Door) bypasses DNS propagation delays for failover, offering split-second failover times.

Select the service that meets all criteria natively.

Azure Front Door natively combines global Anycast routing, Layer 7 path-based routing, SSL offloading, and rapid failover via sub-minute health probes.

It fulfills the complete requirement set without introducing regional limits or DNS TTL caching issues.

Key Concept

Azure Front Door is a global, Anycast-based Layer 7 load balancer that supports SSL offloading, path-based routing, and sub-minute global failover, whereas Azure Traffic Manager is a DNS-level load balancer subject to DNS TTL caching.

Estimated Time:1m 30s

Question 1034Question →

A retail corporation is setting up an application environment in Azure. The architecture consists of Azure Virtual Machines deployed in a subnet named AppSubnet inside a virtual network named ProductionVNet. The virtual machines must securely access a single Azure SQL Database instance without exposing the traffic to the public internet. You have provisioned a private endpoint for the database in AppSubnet. You now need to restrict traffic from AppSubnet so that the virtual machines can connect only to the private endpoint of that specific SQL database, and prevent outbound access to any other Azure SQL Databases or public endpoints. Which configuration should you apply to the Network Security Group (NSG) linked to AppSubnet?

Set the private endpoint network policies to Enabled on AppSubnet. Add an outbound rule to the NSG that allows traffic to the private IP address of the private endpoint, followed by a rule with a lower priority that blocks traffic to the Sql service tag.

Add an outbound rule to the NSG that allows traffic to the Sql service tag, which will automatically route all SQL database requests to the private endpoint.

Create a User Defined Route (UDR) on AppSubnet that redirects all traffic destined for the Sql service tag to the private endpoint's IP address as the next hop.

Add an outbound rule to the NSG that allows traffic to a custom service tag defined specifically for the private endpoint, and create another rule to block the Internet service tag.

Show answer & explanation

Answer: Set the private endpoint network policies to Enabled on AppSubnet. Add an outbound rule to the NSG that allows traffic to the private IP address of the private endpoint, followed by a rule with a lower priority that blocks traffic to the Sql service tag.

Answer

Set the private endpoint network policies to Enabled on AppSubnet, allow traffic to the private IP address of the private endpoint in the NSG, and block traffic to the Sql service tag with a lower priority rule.

To apply Network Security Group rules to private endpoints, you must first enable private endpoint network policies on the subnet. Once enabled, you can control traffic to the private endpoint using its private IP address. To prevent access to other Azure SQL Databases over their public endpoints, you block the Sql service tag. Because NSG rules are processed in priority order, the specific allow rule for the private endpoint's IP address will be processed first, and any other traffic to Azure SQL public endpoints will be blocked by the Sql service tag rule.

Step-by-Step Solution

Enable private endpoint network policies on the subnet.

This allows the subnet's Network Security Group (NSG) rules to be applied to traffic destined for private endpoints.

By default, NSG rules are not enforced on private endpoints.

Create an outbound NSG rule to allow traffic to the private IP address of the private endpoint.

Traffic from the Virtual Machines to the database private endpoint is permitted.

Private endpoint traffic uses the private IP address allocated within the subnet.

Create a lower-priority outbound NSG rule to deny traffic to the Sql service tag.

All other traffic targeting Azure SQL Database public endpoints is blocked.

This satisfies the security requirement to prevent outbound access to other Azure SQL Databases or public endpoints.

Key Concept

Applying Network Security Group (NSG) rules to Private Endpoints using network policies

Question 1035Question →

An enterprise deploys a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-core` ( $10.100.0.0/16$ ), contains an Azure Firewall at $10.100.4.4$ . The first spoke virtual network, `vnet-spoke-web` ( $10.110.0.0/16$ ), hosts web servers in a subnet named `snet-web` ( $10.110.1.0/24$ ). The second spoke virtual network, `vnet-spoke-db` ( $10.120.0.0/16$ ), hosts database servers in a subnet named `snet-db` ( $10.120.1.0/24$ ). Both spoke virtual networks are peered directly with the hub virtual network, but they are not peered with each other. To route all egress traffic from `vnet-spoke-web` to the database servers through the Azure Firewall for security inspection, the network architect associates a custom route table named `rt-web-transit` with the `snet-web` subnet. The route table includes a single user-defined route (UDR) with the address prefix $10.0.0.0/8$ and the next hop set to the Azure Firewall ( $10.100.4.4$ ). During testing, VMs in `snet-web` can successfully connect to databases in `snet-db`, but traffic is not logged or inspected by the Azure Firewall. Which configuration change must be made to ensure that traffic from `vnet-spoke-web` to `vnet-spoke-db` is routed through the Azure Firewall?

Add a route to `rt-web-transit` with the address prefix

10.120.0.0/16

and the next hop set to the Azure Firewall (

10.100.4.4

Add a route to `rt-web-transit` with the address prefix

10.110.0.0/16

and the next hop set to the Azure Firewall (

10.100.4.4

), and disable gateway route propagation.

Modify the peering connection between `vnet-spoke-web` and `vnet-hub-core` to enable the 'Use remote gateways' option, and enable gateway transit on the hub.

Delete the peering connections to the hub, and create a direct virtual network peering between `vnet-spoke-web` and `vnet-spoke-db` with gateway transit enabled.

Show answer & explanation

Answer: Add a route to `rt-web-transit` with the address prefix $10.120.0.0/16$ and the next hop set to the Azure Firewall ( $10.100.4.4$ ).

Answer

Add a route to `rt-web-transit` with the address prefix

10.120.0.0/16

and the next hop set to the Azure Firewall (

10.100.4.4

The correct answer is correct because Azure virtual network peering injects system routes for peered address spaces (in this case,

10.120.0.0/16

with next hop 'VNet Peering'). Azure evaluates matching routes using Longest Prefix Match (LPM). Because the destination database IP matches the

/16

system route, which is a longer prefix than the custom

/8

route (

10.0.0.0/8

), the traffic bypasses the firewall. Adding a UDR that matches the exact prefix (

10.120.0.0/16

) overrides the system route because UDRs take precedence over system routes when prefix lengths are identical.

Step-by-Step Solution

Analyze the destination IP space and active routes on the source subnet.

Traffic from `snet-web` (

10.110.1.0/24

) destined for `vnet-spoke-db` (

10.120.0.0/16

) has two matching routes: the system-defined VNet Peering route (

10.120.0.0/16

) and the custom UDR (

10.0.0.0/8

Identifying all matching routes helps determine which route Azure will select to forward packets.

Evaluate the route selection precedence based on prefix length.

Azure uses Longest Prefix Match (LPM) to select routes. The

/16

system route is more specific than the

/8

user-defined route, so the system route is selected and traffic bypasses the firewall.

Understanding LPM is critical to identifying why the broad UDR fails to intercept peered VNet traffic.

Override the system route with a specific user-defined route.

Add a route with the exact prefix

10.120.0.0/16

pointing to the Azure Firewall (

10.100.4.4

). When prefix lengths are identical, User-Defined Routes take precedence over system routes.

Adding a matching prefix length UDR successfully forces Azure to select the firewall as the next hop.

Key Concept

Azure Routing Selection Rules and Peering Precedence

Estimated Time:2m 0s

Question 1036Question →

Your company is planning to migrate its on-premises VMware vSphere virtual machines to Azure. You need to use Azure Migrate to discover the virtual machines and perform an agentless dependency analysis. Which two tasks must you perform on-premises to complete the discovery and dependency assessment? (Choose two.)

Select all that apply

Deploy the Azure Migrate appliance as a VMware OVA template.

Configure credentials on the Azure Migrate appliance to access the vCenter Server.

Install the Dependency agent on every on-premises virtual machine.

Deploy Microsoft Entra Connect with Active Directory Federation Services (AD FS).

Provision an Azure SQL Database Managed Instance in the target subscription.

Show answer & explanation

Answer: Deploy the Azure Migrate appliance as a VMware OVA template.; Configure credentials on the Azure Migrate appliance to access the vCenter Server.

Answer

Deploying the Azure Migrate appliance as a VMware OVA template and configuring credentials on the Azure Migrate appliance to access the vCenter Server.

Performing agentless discovery and dependency analysis in a VMware vSphere environment requires deploying the Azure Migrate appliance (using an OVA template) on-premises and configuring it with credentials to access the vCenter Server. This allows the appliance to connect to the vCenter Server and pull metadata and dependency information without needing to install agents inside each VM guest operating system.

Step-by-Step Solution

Identify the migration method and assessment type.

The requirement is to discover VMware vSphere virtual machines and perform agentless dependency analysis using Azure Migrate.

Agentless dependency analysis relies on the Azure Migrate appliance without needing agent installations inside the guest operating systems of the VMs.

Determine the necessary on-premises components for discovery.

The Azure Migrate appliance must be downloaded as an OVA template and deployed on the VMware environment, and credentials to access vCenter Server must be configured.

The appliance uses these credentials to pull inventory and dependency data directly from the VMware control plane.

Key Concept

Azure Migrate agentless discovery and dependency assessment for VMware environments.

Estimated Time:1m 0s

Question 1037Question →

An enterprise is planning a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-east-hub` ( $10.10.0.0/16$ ), contains a Virtual Network Gateway connected to an on-premises network ( $192.168.1.0/24$ ) via a Site-to-Site VPN. The spoke virtual network, `vnet-east-spoke` ( $10.20.0.0/16$ ), hosts application virtual machines. You must ensure that all outbound internet traffic from `vnet-east-spoke` is forced to route through the Virtual Network Gateway in `vnet-east-hub` to the on-premises firewall for inspection.

Which two configuration steps should you include in the design?

Select all that apply

Configure the virtual network peering connection to allow gateway transit on `vnet-east-hub` and use remote gateways on `vnet-east-spoke`.

Create a route table with a user-defined route for

0.0.0.0/0

pointing to the Virtual Network Gateway as the next hop, and associate it with the subnets in `vnet-east-spoke`.

Create a route table with a user-defined route for

0.0.0.0/0

pointing to the spoke virtual network address space, and associate it with the GatewaySubnet in `vnet-east-hub`.

Configure a Network Security Group (NSG) in `vnet-east-spoke` with an outbound security rule that permits traffic to the Internet service tag via the VPN Gateway.

Show answer & explanation

Answer: Configure the virtual network peering connection to allow gateway transit on `vnet-east-hub` and use remote gateways on `vnet-east-spoke`.; Create a route table with a user-defined route for $0.0.0.0/0$ pointing to the Virtual Network Gateway as the next hop, and associate it with the subnets in `vnet-east-spoke`.

Answer

To route all outbound internet traffic from the spoke VNet to the on-premises firewall, you must configure the virtual network peering connection to allow gateway transit on the hub and use remote gateways on the spoke, and create a route table with a user-defined route for

0.0.0.0/0

pointing to the Virtual Network Gateway, associating it with the spoke subnets.

To implement forced tunneling from the spoke VNet, you must allow transit across the peered virtual networks and define a custom default route. Configuring the peering to use the remote gateway enables the spoke VNet to access the hub's gateway. Associating a route table to the spoke subnets with a

0.0.0.0/0

UDR pointing to the Virtual Network Gateway ensures all outbound internet-bound traffic is forwarded to the hub's gateway rather than egressing directly to the internet.

Step-by-Step Solution

Configure virtual network peering settings for gateway transit.

Enable gateway transit on the hub VNet peering side (`vnet-east-hub`) and remote gateway usage on the spoke VNet peering side (`vnet-east-spoke`).

This permits resources in the spoke virtual network to reach and use the VPN gateway located in the hub virtual network.

Define custom routing on the spoke subnets.

Create a route table with a default route of

0.0.0.0/0

pointing to the Virtual Network Gateway next hop, and associate it with the spoke subnets.

Azure's default system routing sends internet-bound traffic directly to the internet. A UDR is required to override this behavior and force the traffic to the VPN Gateway.

Key Concept

Forced tunneling in Azure hub-and-spoke networks using virtual network peering and user-defined routes.

Estimated Time:1m 30s

Question 1038Question →

A company named Apex Health is designing a secure architecture in Azure to comply with healthcare data regulations. The architecture includes a virtual network named VNet-Prod containing a subnet named Subnet-Web, where virtual machines process medical records. The application must write these records to an Azure Storage account named storepatientdata.

You need to recommend a network security solution that meets the following requirements:
- Virtual machines in Subnet-Web must access storepatientdata using a private connection that does not traverse the public internet.
- Virtual machines in Subnet-Web must be prevented from exfiltrating data to any other Azure Storage accounts, including those in other subscriptions.
- Public internet access to the storage account must be disabled.
- The solution must minimize administrative overhead and avoid configuring user-defined routes (UDRs) or custom firewall virtual appliances.

Which two actions should you include in the recommendation?

Select all that apply

Enable a virtual network service endpoint for Microsoft.Storage on Subnet-Web and associate a service endpoint policy that permits access only to storepatientdata.

Configure the firewalls and virtual networks settings of storepatientdata to restrict access to Subnet-Web in VNet-Prod and deny public access.

Associate a Network Security Group (NSG) with Subnet-Web and configure an outbound security rule that permits traffic only to the Storage service tag.

Configure a User-Defined Route (UDR) on Subnet-Web to route all traffic destined for the storage account to a custom firewall virtual appliance that performs packet inspection.

Show answer & explanation

Answer: Enable a virtual network service endpoint for Microsoft.Storage on Subnet-Web and associate a service endpoint policy that permits access only to storepatientdata.; Configure the firewalls and virtual networks settings of storepatientdata to restrict access to Subnet-Web in VNet-Prod and deny public access.

Answer

The correct recommendations are to enable a virtual network service endpoint for Microsoft.Storage on Subnet-Web with an associated service endpoint policy that restricts access to storepatientdata, and to configure the firewall settings of storepatientdata to restrict access to Subnet-Web in VNet-Prod and deny public access.

To satisfy the requirements securely and with minimal administrative overhead, you must combine virtual network service endpoints, service endpoint policies, and storage firewalls. Enabling the Microsoft.Storage service endpoint on Subnet-Web ensures database traffic is routed internally via the Azure backbone network. Attaching a service endpoint policy to Subnet-Web restricts outbound access exclusively to the storepatientdata storage account, preventing data exfiltration to other storage accounts. Finally, configuring the firewalls and virtual networks settings on the storage account itself restricts incoming traffic to Subnet-Web of VNet-Prod and denies public internet access, securing the data at rest and in transit.

Step-by-Step Solution

Secure the transit path from the subnet to Azure Storage.

Enable a service endpoint for Microsoft.Storage on the subnet, routing storage traffic through the Microsoft backbone.

This satisfies the requirement for a private connection that does not traverse the public internet without the need for complex VPNs or ExpressRoute.

Prevent data exfiltration to unauthorized storage accounts.

Associate a Service Endpoint Policy with the subnet, specifically listing the resource ID of storepatientdata.

Service endpoint policies filter outbound database/storage traffic over service endpoints, blocking access to other storage accounts while keeping administrative overhead minimal.

Restrict storage account access at the target side.

Configure the storage account firewall to restrict access to VNet-Prod and Subnet-Web, and disable public network access.

This blocks public internet access and ensures only the authorized subnet can connect to the storage account.

Key Concept

Azure Virtual Network Service Endpoints and Service Endpoint Policies

Estimated Time:2m 0s

Question 1039Question →

An enterprise architecture team is designing a data retention strategy for database transaction backups stored in an Azure Blob Storage General-purpose v2 (GPv2) account. The backups must be managed according to the following requirements:

* Backups must be immediately available for recovery operations for the first 45 days after creation, with sub-second retrieval times.
* Between 46 days and 365 days, the backups are occasionally needed for testing and must be retrievable within a few seconds.
* After 365 days, the backups must be retained for an additional 4 years to meet regulatory compliance. They are rarely accessed, and a retrieval latency of up to 15 hours is acceptable.
* The design must minimize storage and retrieval costs.

Which two actions should you include in the lifecycle management policy?

Select all that apply

Transition the backups to the Cool tier 45 days after creation.

Transition the backups to the Archive tier 365 days after creation.

Transition the backups to the Archive tier 45 days after creation.

Transition the backups to the Archive tier 15 days after creation.

Show answer & explanation

Answer: Transition the backups to the Cool tier 45 days after creation.; Transition the backups to the Archive tier 365 days after creation.

Answer

Include the actions to transition the backups to the Cool tier 45 days after creation and transition the backups to the Archive tier 365 days after creation.

Transitioning the backups to the Cool tier 45 days after creation ensures they remain online with sub-second retrieval speeds for the subsequent compliance checks up to day 365. Transitioning the backups to the Archive tier after 365 days minimizes storage costs for the remaining 4 years of regulatory retention, where standard rehydration latency (up to 15 hours) is acceptable.

Step-by-Step Solution

Evaluate the access requirements for the first 45 days.

The backups must remain in the Hot tier (the default tier upon upload) for 45 days to support immediate, sub-second retrieval times for recovery operations.

Moving backups to Cool or Archive prior to 45 days would either incur higher early transaction costs or violate the immediate availability requirement.

Evaluate the access requirements between 46 and 365 days.

Transition the backups to the Cool tier 45 days after creation. Cool tier supports millisecond-level retrieval times (a few seconds) at a reduced storage cost compared to the Hot tier.

This satisfies the requirement for occasional retrieval within a few seconds while optimizing storage costs.

Evaluate the access requirements after 365 days.

Transition the backups to the Archive tier 365 days after creation.

After one year, the backups are rarely accessed and can tolerate a retrieval latency of up to 15 hours. The Archive tier is the most cost-effective tier for this pattern, and standard rehydration times fall within the 15-hour threshold.

Key Concept

Azure Blob Storage lifecycle management policies automate the transition of data between Hot, Cool, and Archive tiers based on age and access patterns, balancing retrieval latency and storage costs.

Question 1040Question →

An educational technology company is designing a serverless backend for a new exam preparation platform. The solution has the following workload requirements:

* A user-facing quiz API that serves questions and records user responses. The API experiences unpredictable traffic spikes but is completely idle during late-night hours. Responses must be returned within $2$ seconds, and minimizing idle hosting costs is a priority.
* A background transcript processing service that runs whenever a new lecture video is uploaded. This service calls an external AI service to generate practice questions, which can take up to $15$ minutes to complete due to API throttling.

Which two hosting and processing options should you select to implement this architecture? (Select TWO.)

Select all that apply

Azure Functions on a Consumption plan to host the user-facing quiz API

Azure Container Apps Jobs to run the background transcript processing service

Azure Functions on a Consumption plan to run the background transcript processing service

Azure Kubernetes Service (AKS) to host both the quiz API and the background transcript processing service

Azure App Service on a Premium v3 plan to host the user-facing quiz API

Show answer & explanation

Answer: Azure Functions on a Consumption plan to host the user-facing quiz API; Azure Container Apps Jobs to run the background transcript processing service

Answer

To implement this architecture, you should select Azure Functions on a Consumption plan to host the user-facing quiz API, and Azure Container Apps Jobs to run the background transcript processing service.

Hosting the user-facing quiz API on Azure Functions on a Consumption plan is correct because it scales down to zero instances when idle, removing hosting costs during late-night hours, while maintaining the ability to quickly scale up to meet spikes. Running the background transcript processing service on Azure Container Apps Jobs is correct because it is designed for execution of short-lived, event-driven container tasks that can run for up to several hours, satisfying the

15

-minute execution requirement without incurring continuous VM costs.

Step-by-Step Solution

Analyze the execution time constraints for the background transcript processing service.

The background transcript service takes up to

15

minutes to complete.

Azure hosting choices have execution limits that must accommodate the maximum expected runtime.

Evaluate the background processing service options against the execution limits.

Azure Functions on a Consumption plan has a strict

10

-minute execution limit, which would cause timeouts. Azure Container Apps Jobs supports executions that run up to several hours, making it the appropriate serverless choice.

Using a serverless service that matches the runtime duration avoids execution failures due to timeouts.

Analyze the cost and scaling requirements for the user-facing quiz API.

The API requires low response times, has unpredictable spikes, and is idle at night. It must scale to zero to minimize idle hosting costs.

Selecting a hosting tier that supports scale-to-zero is critical for meeting the cost-minimization requirements.

Evaluate the quiz API hosting options against the cost and scaling requirements.

Azure Functions on a Consumption plan scales to zero when idle, resulting in zero hosting costs during off-peak hours, and handles rapid scaling during spikes. In contrast, Azure App Service (Premium v3) and Azure Kubernetes Service have continuous baseline costs and do not scale to zero.

Matching the API workload with the correct consumption model prevents waste and ensures rapid responsiveness.

Key Concept

Matching Azure serverless and containerized workloads to hosting options based on execution limits, scalability requirements, and cost-efficiency.

Estimated Time:2m 0s

PreviousPage 52 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution