All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

An organization plans to migrate a multi-tier business application from an on-premises datacenter to Azure. The application runs across 15 interconnected virtual machines. You must ensure that when these virtual machines are migrated, no critical network connections between the servers are broken, which would cause application downtime. Which feature or capability should you use to identify the network connections between these servers before grouping them for migration?

Active Directory Federation Services (AD FS) synchronization

Manual server grouping based solely on naming conventions

Azure Migrate dependency analysis

Azure SQL Database migration assessment

Show answer & explanation

Answer: Azure Migrate dependency analysis

Answer

Azure Migrate dependency analysis

Azure Migrate dependency analysis enables the visualization of network connections between servers to ensure that all interconnected workloads are migrated together.

Step-by-Step Solution

Identify the primary requirement: mapping network connections between virtual machines before migrating to avoid application downtime.

Network topology discovery is needed.

Ensuring dependent VMs are grouped together prevents broken connections.

Evaluate features within Azure Migrate that analyze network communication.

Dependency analysis matches this capability.

It detects TCP connections between source and destination servers.

Select Azure Migrate dependency analysis.

The correct capability is chosen.

It visualizes and groups dependent servers accurately.

Key Concept

Using dependency analysis to map server connections during migration assessment

Question 1042Question →

An organization is designing the compute architecture for a core ledger processing system on Azure. The system will run on Azure Virtual Machines.

The system has the following requirements:
- The virtual machine instances must guarantee a cumulative uptime SLA of at least 99.99%.
- The instances must be placed to ensure the lowest possible network latency for inter-VM communication within each localized partition.

Which of the following compute deployment strategies should you recommend?

Deploy the virtual machines across multiple Availability Zones, and associate the instances within each zone with a zone-specific Proximity Placement Group.

Deploy the virtual machines in an Availability Set, and associate the Availability Set with a single Proximity Placement Group.

Deploy the virtual machines within a single Availability Zone, and associate all instances with a single Proximity Placement Group.

Deploy the virtual machines across multiple Availability Zones using Spot Virtual Machines in a Virtual Machine Scale Set in Flexible orchestration mode.

Show answer & explanation

Answer: Deploy the virtual machines across multiple Availability Zones, and associate the instances within each zone with a zone-specific Proximity Placement Group.

Answer

Deploy the virtual machines across multiple Availability Zones, and associate the instances within each zone with a zone-specific Proximity Placement Group.

Deploying the virtual machines across multiple Availability Zones satisfies the 99.99% uptime SLA requirement. To maintain low latency for the VMs within the same zone, a separate Proximity Placement Group (PPG) should be created and associated with the VMs in each respective zone. A single PPG spanning multiple zones is not recommended because it can lead to deployment failures or fail to achieve the desired low latency across physical zonal boundaries.

Step-by-Step Solution

Evaluate the SLA requirements against Azure VM deployment options.

To guarantee a 99.99% VM uptime SLA, the virtual machines must be deployed across two or more Availability Zones in the same region. Deployments in Availability Sets or a single zone only offer up to 99.95% SLA.

This establishes the baseline infrastructure requirement for the high availability target.

Evaluate the network latency requirements within the multi-zone topology.

To achieve the lowest possible network latency, virtual machines must be physically colocated near each other. However, a single Proximity Placement Group (PPG) spanning multiple zones is not recommended as it cannot guarantee low latency across zones and may lead to deployment failures.

This defines the constraint for low-latency placement in a zonal architecture.

Select the correct combination of zonal deployment and placement groups.

Associating VMs in each zone with a zone-specific PPG ensures low latency within the zone (localized partitions) while maintaining the 99.99% SLA across zones.

This satisfies both the high availability SLA and the localized network performance requirement.

Key Concept

Azure VM High Availability SLAs and Proximity Placement Groups

Question 1043Question →

An organization is designing a multi-tier web application on Azure. The application's backend web tier consists of $4$ Azure Virtual Machines that require a cumulative compute SLA of $99.99\%$ and low-latency network communication between the virtual machines to support high-throughput in-memory caching. You need to design the compute infrastructure. Which two configurations should you include in the design? (Each correct answer presents part of the complete solution.)

Select all that apply

Deploy the virtual machines across two or more Availability Zones in the region.

Deploy the virtual machines in a single Proximity Placement Group.

Deploy all virtual machines within a single Availability Zone using an Availability Set.

Deploy the virtual machines as Azure Spot VMs in a single scale set.

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones in the region.; Deploy the virtual machines in a single Proximity Placement Group.

Answer

To meet the requirements, the design must include deploying the virtual machines across multiple Availability Zones to achieve the

99.99\%

SLA, and placing them in a single Proximity Placement Group to ensure low-latency communication.

To meet the

99.99\%

SLA requirement, virtual machines must be deployed across two or more Availability Zones in the same region. To meet the low-latency placement requirement, a Proximity Placement Group should be used to physically group the virtual machines.

Step-by-Step Solution

Determine the configuration required to meet the

99.99\%

uptime SLA.

Identify that Azure guarantees a

99.99\%

SLA only when two or more instances are deployed across two or more Availability Zones in the same region.

This guarantees that the virtual machines are distributed across isolated power, cooling, and networking zones.

Determine the configuration required to meet the low-latency communication requirement.

Identify that a Proximity Placement Group is needed to group the VMs physically closer to reduce network latency.

Proximity Placement Groups ensure that VMs are located in the same physical datacenter to minimize latency.

Key Concept

Azure virtual machine high availability design using Availability Zones for SLA and Proximity Placement Groups for low latency.

Question 1044Question →

An enterprise is designing a hub-and-spoke network topology in Azure to host a secure multi-tier application. The design includes the following components:

* A hub virtual network ( $\text{VNet-Hub}$ ) containing an Azure Firewall and an Azure Private DNS Resolver with an inbound endpoint configured.
* A spoke virtual network ( $\text{VNet-App}$ ) peered with $\text{VNet-Hub}$ . This virtual network contains a subnet named $\text{Subnet-App}$ hosting application virtual machines.
* A spoke virtual network ( $\text{VNet-Data}$ ) peered with $\text{VNet-Hub}$ . This virtual network contains a subnet named $\text{Subnet-Data}$ hosting an Azure SQL Database with a Private Endpoint.
* An Azure Private DNS Zone named `privatelink.database.windows.net` containing the DNS record for the Private Endpoint, linked to $\text{VNet-Hub}$ .

Your design must meet the following requirements:
* The virtual machines in $\text{Subnet-App}$ must connect to the Azure SQL Database using its Private Endpoint.
* All traffic between $\text{Subnet-App}$ and the Private Endpoint must be routed through and inspected by the Azure Firewall in $\text{VNet-Hub}$ .
* You must minimize administrative overhead and avoid linking the Private DNS Zone `privatelink.database.windows.net` to multiple virtual networks.

Which two actions should you perform?

Select all that apply

Configure the DNS servers setting of VNet-App to use the IP address of the Azure Private DNS Resolver inbound endpoint.

In the properties of Subnet-Data, enable network policies for private endpoints.

Associate a network security group (NSG) with Subnet-App and configure outbound security rules targeting individual public IP addresses of the Azure SQL Database service.

In the route table associated with Subnet-App, create a user-defined route with the destination prefix 0.0.0.0/0 and the next hop set to the Private Endpoint IP address.

Show answer & explanation

Answer: Configure the DNS servers setting of VNet-App to use the IP address of the Azure Private DNS Resolver inbound endpoint.; In the properties of Subnet-Data, enable network policies for private endpoints.

Answer

Configure the DNS servers setting of VNet-App to use the IP address of the Azure Private DNS Resolver inbound endpoint, and enable network policies for private endpoints on Subnet-Data.

Configuring the DNS server setting of the spoke virtual network to point to the Azure Private DNS Resolver inbound endpoint enables seamless name resolution across VNets without linking the Private DNS Zone directly to every spoke. Furthermore, enabling network policies for private endpoints on the destination data subnet is required so that Azure honors user-defined routes and NSGs, ensuring that database traffic is routed through the firewall instead of bypassing it.

Step-by-Step Solution

Configure DNS resolution for the spoke virtual network.

By setting the DNS server of VNet-App to the Private DNS Resolver's inbound endpoint IP address, VM DNS queries are forwarded to VNet-Hub, which can resolve the private link zone.

This allows the application VMs to resolve the SQL database's private FQDN to its private endpoint IP without creating duplicate links to the DNS zone.

Enable network policies on the private endpoint subnet.

Enabling subnet network policies for private endpoints allows Azure to respect user-defined routes (UDRs) and Network Security Groups (NSGs) on the private endpoint's interface.

By default, UDRs and NSGs are bypassed for private endpoint traffic. Enabling this policy ensures that return traffic from the database back to the application VM is routed through the Azure Firewall.

Associate a route table with Subnet-App routing traffic to the Azure Firewall.

A UDR on Subnet-App directs traffic bound for the SQL Private Endpoint to the Azure Firewall private IP address.

This guarantees that outbound traffic from the application layer to the database layer is inspected by the firewall.

Key Concept

Azure Private Endpoint Routing and DNS Integration in Hub-Spoke Architectures

Question 1045Question →

Your company is designing a secure network architecture for an Azure-hosted application. The application runs on Azure Virtual Machines deployed in a virtual network named VNet1. The application requires outbound access to an Azure Storage account and an Azure Key Vault. You need to recommend a network security solution that meets the following requirements:
- Prevent all access to the storage account and key vault from the public internet.
- Ensure the virtual machines can resolve and connect to the services using their default fully qualified domain names (FQDNs).
- Minimize the administrative effort required to configure and maintain network access controls.

Which of the following designs should you recommend?

Restrict access at the subnet level by deploying a Network Security Group (NSG) with individual outbound rules containing the current public IP address ranges of the Azure Storage and Azure Key Vault regional endpoints.

Configure Private Endpoints for the storage account and key vault in VNet1, disable public access on both services, and link Azure Private DNS zones for the services to VNet1.

Configure Virtual Network service endpoints for the storage account and key vault, and define a custom route table containing User-Defined Routes (UDRs) that direct all VNet1 subnet traffic to the default internet gateway to reach the endpoints.

Deploy a Standard Load Balancer in VNet1 to manage outbound connections to the storage account, and configure the backend pool using virtual machines that are associated with Basic SKU public IP addresses.

Show answer & explanation

Answer: Configure Private Endpoints for the storage account and key vault in VNet1, disable public access on both services, and link Azure Private DNS zones for the services to VNet1.

Answer

Configure Private Endpoints for the storage account and key vault in VNet1, disable public access on both services, and link Azure Private DNS zones for the services to VNet1.

The correct design uses Private Endpoints to assign private IP addresses from VNet1 to the storage account and key vault. Disabling public access ensures that traffic to these resources is blocked from the public internet. Linking the corresponding Azure Private DNS zones to VNet1 ensures that name resolution for the default FQDNs resolves to the private IP addresses automatically, satisfying the requirements with minimal administrative overhead.

Step-by-Step Solution

Select Private Access Method

Identify Private Endpoints as the solution to provide private IP addresses inside VNet1 for Azure Storage and Key Vault.

Private Endpoints satisfy the requirement to block all public internet access by routing traffic privately over the Microsoft backbone network.

Configure Name Resolution

Create and link Private DNS zones for the services to VNet1.

This enables virtual machines to resolve the default fully qualified domain names (FQDNs) to the private IP addresses of the Private Endpoints without requiring custom host files or manual DNS management.

Minimize Administrative Effort

Disable public endpoint access on the Azure Storage and Key Vault resources.

This centralizes security controls at the resource firewall layer rather than manually maintaining complex NSG rules or user-defined routes.

Key Concept

Private Link and Private DNS Integration

Question 1046Question →

A digital publishing company is designing a serverless solution to generate quarterly PDF reports for subscribers. The report generation process runs on demand, takes approximately 12 to 15 minutes to compile each document, and requires a custom Linux environment with specific PDF compilation libraries. The workload is highly irregular, and the company wants to ensure that they do not pay for compute resources when no reports are being generated.

Which compute service should you recommend?

Azure Container Apps Jobs

Azure Functions on a Consumption plan

Azure Kubernetes Service (AKS) with virtual nodes

Azure App Service (Web App for Containers) on a Dedicated Premium v3 plan

Show answer & explanation

Answer: Azure Container Apps Jobs

Answer

Azure Container Apps Jobs

The correct option is Azure Container Apps Jobs because it supports running custom Linux container environments for run-to-completion tasks, scales to zero when no jobs are running to avoid idle costs, and does not have the 10-minute execution limit that affects Azure Functions on a Consumption plan.

Step-by-Step Solution

Analyze the execution duration requirement

The workload runs for 12 to 15 minutes, which rules out options with a strict 10-minute timeout limit.

Establishing execution boundaries is critical for selecting the correct serverless hosting model.

Analyze the scaling and cost requirements

The system must scale to zero and incur no costs when idle, which rules out dedicated hosting plans.

Meeting the cost-efficiency constraint requires a serverless billing model.

Evaluate operational overhead and dependency requirements

Azure Container Apps Jobs supports custom containers and scales to zero without the operational complexity of managing an AKS cluster.

Choosing the service with the lowest operational overhead that fulfills all technical criteria.

Key Concept

Azure serverless compute selection based on execution duration, custom dependencies, and cost constraints.

Question 1047Question →

An enterprise is designing a hub-and-spoke network topology in Azure. The topology consists of the following components:
* A hub virtual network named `vnet-neur-hub` ( $10.10.0.0/16$ ) containing an Azure Firewall deployed at IP address $10.10.1.4$ .
* A production spoke virtual network named `vnet-neur-prod` ( $10.20.0.0/16$ ) peered with `vnet-neur-hub`.
* A shared services spoke virtual network named `vnet-neur-shared` ( $10.30.0.0/16$ ) peered with `vnet-neur-hub`.

There is no direct virtual network peering between `vnet-neur-prod` and `vnet-neur-shared`.

You need to implement a routing design that achieves the following objectives:
1. All outbound internet traffic from `vnet-neur-prod` must transit through the Azure Firewall.
2. All traffic from `vnet-neur-prod` destined for `vnet-neur-shared` must transit through the Azure Firewall.
3. All traffic between resources within `vnet-neur-prod` must route directly within the virtual network without traversing the firewall.

Which TWO actions should you perform to configure the route table associated with the subnets in `vnet-neur-prod`?

Select all that apply

Add a route for

0.0.0.0/0

with a next hop of Virtual Appliance and IP address

10.10.1.4

Add a route for

10.30.0.0/16

with a next hop of Virtual Appliance and IP address

10.10.1.4

Add a route for

10.20.0.0/16

with a next hop of Virtual Appliance and IP address

10.10.1.4

Add a route for

10.10.0.0/16

with a next hop of Virtual Appliance and IP address

10.10.1.4

Show answer & explanation

Answer: Add a route for $0.0.0.0/0$ with a next hop of Virtual Appliance and IP address $10.10.1.4$ .; Add a route for $10.30.0.0/16$ with a next hop of Virtual Appliance and IP address $10.10.1.4$ .

Answer

To configure routing for the production spoke subnets, you must add a default route of

0.0.0.0/0

pointing to the Azure Firewall private IP address (

10.10.1.4

) as a Virtual Appliance, and add a route for the shared services spoke VNet range (

10.30.0.0/16

) pointing to the same Azure Firewall IP (

10.10.1.4

) as a Virtual Appliance.

To route internet traffic through the firewall, a default route (

0.0.0.0/0

) pointing to the firewall's private IP (

10.10.1.4

) as a Virtual Appliance next hop is required. To route traffic to the peered spoke VNet, a specific route for

10.30.0.0/16

pointing to the firewall's private IP as a Virtual Appliance next hop is required. These custom routes steer external and cross-spoke traffic through the hub firewall without affecting local VNet traffic, which is automatically handled by the system's local route.

Step-by-Step Solution

Determine the route required to direct outbound internet traffic through the central firewall.

Create a route for

0.0.0.0/0

(the default route representing all external traffic) with a next hop of Virtual Appliance pointing to the firewall IP (

10.10.1.4

This satisfies the requirement that all outbound internet traffic from the production spoke VNet must transit through the Azure Firewall.

Determine the route required to enable cross-spoke communication through the firewall.

Create a route for the target shared services spoke range (

10.30.0.0/16

) with a next hop of Virtual Appliance pointing to the firewall IP (

10.10.1.4

Since Azure virtual network peering is non-transitive by default, traffic between two spokes must be explicitly routed through the firewall in the hub VNet.

Evaluate the impact on local VNet traffic within the production spoke.

Do not define any custom routes for the local VNet prefix (

10.20.0.0/16

) in the route table.

Azure automatically manages intra-VNet routing using the default system route (

10.20.0.0/16

-> Local). Adding a custom route for this prefix would override the system route and break direct subnet-to-subnet connectivity.

Key Concept

Configuring custom routing using User Defined Routes (UDRs) in a hub-and-spoke Azure topology while avoiding overlapping routes that override system-defined local paths.

Question 1048Question →

A media streaming company is designing a serverless backend solution to transcode user-uploaded video files. The transcoding utility is packaged as a custom Docker container image. The transcoding process is event-driven, triggered by new files arriving in an Azure Blob Storage container. Each transcoding operation takes approximately 15 minutes to complete. The company requires a solution that minimizes administrative overhead, scales automatically, and incurs no costs when no video files are being processed. Which Azure service should you recommend?

Azure Container Apps Jobs

Azure Functions on a Consumption plan

Azure Kubernetes Service (AKS) with virtual nodes

Azure App Service on a Dedicated plan

Show answer & explanation

Answer: Azure Container Apps Jobs

Answer

Azure Container Apps Jobs is the recommended service because it runs containerized batch workloads to completion, scales to zero to avoid idle costs, and does not impose the 10-minute timeout constraint found in Azure Functions Consumption plans.

Azure Container Apps Jobs is the ideal option because it is built for run-to-completion, containerized event-driven tasks. It supports custom container images, scales to zero when no executions are triggered, and allows jobs to run for up to 24 hours, comfortably accommodating the 15-minute runtime requirement.

Step-by-Step Solution

Analyze the execution duration requirement.

The transcoding process requires 15 minutes of execution time.

This exceeds the maximum 10-minute execution limit of the Azure Functions Consumption plan, ruling it out.

Evaluate cost and scaling requirements.

The solution must scale to zero and incur zero costs when idle.

This eliminates Dedicated App Service plans and Azure Functions Premium plans, both of which require minimum running instances and incur base fees when idle.

Analyze containerization and administrative overhead.

The utility is a custom container image and needs minimal management overhead.

Azure Container Apps Jobs is fully managed, supports custom containers, runs containerized tasks to completion (up to 24 hours), and scales to zero, meeting all criteria without the complexity of managing an AKS cluster.

Key Concept

Selecting serverless hosting options for event-driven, containerized, run-to-completion tasks that exceed standard function timeouts.

Question 1049Question →

Match each application architecture scenario to the most appropriate Azure load balancing or traffic routing service. Each service may be used once, more than once, or not at all.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The global web application with SSL offloading and Anycast routing matches Azure Front Door. The global TCP application using DNS routing matches Azure Traffic Manager. The regional web application with private backend IPs and WAF matches Azure Application Gateway. The regional database cluster matches Azure Load Balancer.

The correct matches are based on mapping the architectural scope (global vs. regional) and the required networking layer (Layer 4 vs. Layer 7). Global Layer 7 routing with Anycast maps to Azure Front Door. Global DNS-based Layer 4 routing maps to Azure Traffic Manager. Regional Layer 7 routing with private IP backends and WAF maps to Azure Application Gateway. Regional Layer 4 high-performance TCP load balancing maps to Azure Load Balancer.

Step-by-Step Solution

Determine the scope (global vs. regional) for each application requirement.

The global web application and the global TCP application require global solutions. The regional web application and database cluster require regional solutions.

This narrows down the choices between global services (Front Door, Traffic Manager) and regional services (Application Gateway, Load Balancer).

Analyze the network layer requirements (Layer 4 vs. Layer 7) for the global services.

The global web application requires Layer 7 features (SSL offloading, URL routing) and maps to Azure Front Door. The global TCP application requires Layer 4/DNS routing and maps to Azure Traffic Manager.

Azure Front Door is a Layer 7 service, while Azure Traffic Manager works at the DNS layer (Layer 4/any protocol).

Analyze the network layer and security requirements for the regional services.

The regional web application requires Layer 7 features (URL routing, private backend IPs, WAF) and maps to Azure Application Gateway. The regional database requires high-performance Layer 4 load balancing and maps to Azure Load Balancer.

Azure Application Gateway provides regional Layer 7 capabilities, while Azure Load Balancer handles high-performance Layer 4 traffic.

Key Concept

Selecting Azure load balancing services based on geographical scope (global vs. regional) and protocol layer (Layer 4 vs. Layer 7).

Question 1050Question →

An organization is designing a hybrid network in Azure to support dynamic routing between their on-premises datacenter ( $192.168.0.0/16$ ) and Azure resources.

The architecture consists of the following components:
- A hub virtual network named `vnet-useast-hub-transit` ( $10.30.0.0/16$ ) that hosts an Azure Route Server named `ars-useast` in the dedicated `RouteServerSubnet`, an ExpressRoute gateway, and two active-active Network Virtual Appliances (NVAs) that establish BGP sessions with the Route Server.
- A spoke virtual network named `vnet-useast-spoke-prod` ( $10.40.0.0/16$ ) that hosts application workloads.
- A virtual network peering connection between `vnet-useast-hub-transit` and `vnet-useast-spoke-prod`.

The routing requirements are as follows:
- BGP routes from the on-premises datacenter must propagate dynamically to the virtual machines in `vnet-useast-spoke-prod` via the NVAs.
- Static User-Defined Routes (UDRs) must not be configured or managed in `vnet-useast-spoke-prod` to avoid operational overhead.
- Traffic must route dynamically between the ExpressRoute gateway and the NVAs.

Which two configuration settings should you implement to meet these requirements? (Choose two.)

Select all that apply

Enable the branch-to-branch setting on the Azure Route Server `ars-useast`.

Configure the virtual network peering from `vnet-useast-spoke-prod` to `vnet-useast-hub-transit` to use the remote virtual network's gateway or Route Server.

Disable route propagation on the route tables associated with the subnets in `vnet-useast-spoke-prod`.

Create user-defined routes (UDRs) in `vnet-useast-spoke-prod` pointing to the private IP addresses of the NVAs as the next hop.

Associate a route filter with the ExpressRoute circuit targeting the private peering IP addresses of the NVAs.

Show answer & explanation

Answer: Enable the branch-to-branch setting on the Azure Route Server `ars-useast`.; Configure the virtual network peering from `vnet-useast-spoke-prod` to `vnet-useast-hub-transit` to use the remote virtual network's gateway or Route Server.

Answer

To meet the routing requirements, you must enable the branch-to-branch setting on the Azure Route Server `ars-useast` to allow dynamic route exchange between the ExpressRoute gateway and the NVAs, and configure the virtual network peering from the spoke VNet to the hub VNet to use the remote virtual network's gateway or Route Server.

To establish dynamic routing between the ExpressRoute gateway and the NVAs, the branch-to-branch setting must be enabled on the Azure Route Server. This allows the Route Server to transit routes between the virtual network gateway and the BGP-enabled NVAs. Additionally, to propagate these dynamically learned routes to the spoke virtual network without using static routes, the virtual network peering from the spoke VNet to the hub VNet must be configured to use the remote virtual network's gateway or Route Server.

Step-by-Step Solution

Enable dynamic routing between the ExpressRoute gateway and the NVAs.

Dynamic route propagation is established between on-premises and the NVAs.

By default, Azure Route Server does not route traffic directly between gateways. Enabling the branch-to-branch setting allows the Route Server to transit routes between the ExpressRoute gateway and the NVA BGP peers.

Enable route propagation from the hub VNet to the spoke VNet.

The spoke virtual network learns the routes advertised by the Azure Route Server in the hub.

Configuring the virtual network peering from the spoke to use the remote virtual network's gateway or Route Server allows the spoke subnets to dynamically inherit routes from the hub Route Server.

Key Concept

Azure Route Server enables dynamic BGP route propagation across peered VNets and gateways using the branch-to-branch setting without requiring manual user-defined routes.

Question 1051Question →

An agricultural technology startup is designing a serverless architecture to host two workloads:

1. A public API for farmers that experiences highly variable traffic, scaling from zero to thousands of concurrent requests, with a target response time under $200$ ms.
2. A background data analysis job that runs once daily to generate complex crop yield models. This job takes between $15$ to $25$ minutes to complete.

The startup requires a solution that minimizes both operational overhead and cost.

Which two Azure hosting services should you recommend?

Select all that apply

Azure Functions on a Consumption plan to host the public API

Azure Container Apps Jobs to run the daily background data analysis job

Azure Functions on a Consumption plan to run the daily background data analysis job

Azure Kubernetes Service (AKS) to host both the API and the background analysis job

Spot Virtual Machines in a Virtual Machine Scale Set to host the public API

Show answer & explanation

Answer: Azure Functions on a Consumption plan to host the public API; Azure Container Apps Jobs to run the daily background data analysis job

Answer

Azure Functions on a Consumption plan to host the public API, and Azure Container Apps Jobs to run the daily background data analysis job.

The correct recommendation is to host the public API on Azure Functions (Consumption plan) and the background job on Azure Container Apps Jobs. Azure Functions Consumption plan is cost-effective and highly responsive for light, bursty API request patterns. Azure Container Apps Jobs allows containerized tasks to run on-demand for up to multiple hours without timeout issues, fulfilling the requirement for the

15

-to-

25

minute process while remaining fully serverless with minimal administrative overhead.

Step-by-Step Solution

Analyze the API workload requirements.

The API requires rapid scaling from zero, low latency (under

200

ms), and minimal cost. A serverless compute model like Azure Functions on a Consumption plan fits perfectly.

Azure Functions on the Consumption plan scales dynamically and charges only for execution time, aligning with variable API workloads.

Analyze the background job requirements.

The background job runs daily for

15

25

minutes. Standard serverless options like Azure Functions Consumption plan will timeout (max

10

minutes limit).

An alternative serverless processing service that supports longer executions without infrastructure overhead is required, pointing to Azure Container Apps Jobs.

Evaluate operational overhead and cost constraints.

Azure Container Apps Jobs run on demand, scale to zero, and have no platform management overhead. Azure Kubernetes Service (AKS) or Virtual Machines would require active infrastructure management and higher idle costs.

Selecting Azure Container Apps Jobs and Azure Functions minimizes administrative management and keeps resource costs tightly aligned to actual usage.

Key Concept

Selecting Azure hosting plans and services based on execution duration limits, scaling patterns, and administrative overhead.

Estimated Time:2m 0s

Question 1052Question →

A financial services company is designing the compute infrastructure for a real-time foreign exchange trading API. The application will run on $2$ Azure Virtual Machines. The design must meet the following requirements:
- Provide a cumulative virtual machine uptime SLA of $99.99\%$ .
- Minimize network latency between the $2$ virtual machines.

Which infrastructure configuration should you recommend?

Deploy the virtual machines in a single Availability Zone, and associate both virtual machines with a Proximity Placement Group.

Deploy the virtual machines across

2

Availability Zones, and associate both virtual machines with a single Proximity Placement Group.

Deploy the virtual machines in an Availability Set, and associate the Availability Set with a Proximity Placement Group.

Deploy the virtual machines as Spot VMs across

2

Availability Zones, and associate both virtual machines with a single Proximity Placement Group.

Show answer & explanation

Answer: Deploy the virtual machines across $2$ Availability Zones, and associate both virtual machines with a single Proximity Placement Group.

Answer

Deploy the virtual machines across

2

Availability Zones, and associate both virtual machines with a single Proximity Placement Group.

The correct option is deploying the virtual machines across two Availability Zones combined with a single Proximity Placement Group. This configuration meets the

99.99\%

virtual machine uptime SLA requirement by spreading the instances across multiple zones while minimizing latency by using the Proximity Placement Group to co-locate the instances as close as possible within the regional boundaries.

Step-by-Step Solution

Determine the minimum SLA requirements for the virtual machines.

To achieve a

99.99\%

cumulative uptime SLA, the virtual machines must be deployed across at least

2

Availability Zones in the same region.

Single-zone deployments and Availability Sets only offer up to

99.9\%

and

99.95\\%

SLAs, respectively.

Evaluate the placement configuration needed to minimize inter-VM network latency.

A single Proximity Placement Group should be associated with the virtual machines.

Proximity Placement Groups tell Azure to co-locate the virtual machines physically close to each other, minimizing network latency even when they are spread across zones.

Select the appropriate VM lifecycle/billing model for a critical production API.

Avoid Spot VMs and choose standard on-demand or reserved instances.

Spot VMs are subject to eviction and cannot guarantee the

99.99\%

SLA needed for a production trading API.

Key Concept

Azure VM SLA calculations, Availability Zones, and Proximity Placement Groups.

Question 1053Question →

An enterprise is designing a secure administrative management solution for virtual machines deployed in a subnet named ComputeSubnet within a virtual network named VNet1. You deploy Azure Bastion in a subnet named AzureBastionSubnet to provide secure RDP and SSH access. To comply with security policies, you must configure a Network Security Group (NSG) associated with AzureBastionSubnet to restrict outbound traffic to only what is required for Azure Bastion to function properly, including connectivity to Azure public services (such as Azure Active Directory, Azure Monitor, and Azure Storage) for logging and diagnostics. The solution must minimize administrative overhead and avoid manual rule updates when Azure service IP addresses change. Which outbound NSG rule configuration should you recommend for AzureBastionSubnet?

Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.

Create outbound security rules with the destination set to the specific public IP address prefixes of the regional Azure Active Directory, Azure Monitor, and Azure Storage endpoints.

Create an outbound security rule with the destination set to the VirtualNetwork Service Tag and associate a route table with AzureBastionSubnet that has a User Defined Route (UDR) for 0.0.0.0/0 pointing to an on-premises VPN gateway.

Create an outbound security rule with the destination set to the Internet Service Tag for ports 22 and 3389 only, and deny all outbound traffic to the AzureCloud Service Tag.

Show answer & explanation

Answer: Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.

Answer

Create an outbound security rule with the destination set to the AzureCloud Service Tag for ports 443 and 12000.

The correct option is correct because Azure Bastion relies on outbound access to Azure public services (e.g., Azure Active Directory, Azure Monitor, Azure Storage) on port 443 and port 12000 for service telemetry, control plane logging, and validation. The built-in AzureCloud service tag represents these endpoints dynamically, minimizing administrative overhead by automatically updating underlying IP addresses.

Step-by-Step Solution

Analyze Azure Bastion network requirements

Azure Bastion requires outbound access to Azure public endpoints (such as Azure Storage and Azure Monitor) for diagnostic logging and telemetry on ports 443 and 12000.

Ensures that the management plane of the service can communicate with its supporting Azure cloud infrastructure.

Select the most efficient NSG destination type

The AzureCloud Service Tag is chosen over static IP addresses or custom ranges.

Using the built-in Service Tag automatically keeps up with changing IP addresses, eliminating manual maintenance and reducing administrative overhead.

Validate routing constraints

Ensure no default UDR (0.0.0.0/0) is assigned to the AzureBastionSubnet that redirects traffic away from the public internet.

Azure Bastion does not support forced tunneling as it breaks required control plane and certificate validation communications.

Key Concept

Azure Bastion Outbound NSG Rules and Service Tags

Question 1054Question →

Your company is designing the network security architecture for a new application environment in Azure. The application workloads will run on virtual machines in a subnet named ProductionSubnet. The virtual machines must meet the following requirements:
- Outbound access to the public internet must be blocked.
- The virtual machines must be able to securely store files in an Azure Storage account named storage1 without traversing the public internet.
- The virtual machines must be able to send diagnostic logs to Azure Monitor.
- Administrative overhead for managing network access rules must be minimized.

Which two actions should you include in the recommendation?

Select all that apply

Create a Private Endpoint for storage1 in ProductionSubnet.

Associate a Network Security Group (NSG) with ProductionSubnet and configure an outbound security rule that allows traffic to the AzureMonitor service tag.

Associate a Network Security Group (NSG) with ProductionSubnet and configure outbound security rules containing the specific IP address ranges of the Azure Monitor endpoints.

Create a User Defined Route (UDR) in ProductionSubnet that routes 0.0.0.0/0 traffic to the public IP address of storage1.

Deploy a Standard Load Balancer in ProductionSubnet using Basic SKU public IP addresses to provide outbound connectivity.

Show answer & explanation

Answer: Create a Private Endpoint for storage1 in ProductionSubnet.; Associate a Network Security Group (NSG) with ProductionSubnet and configure an outbound security rule that allows traffic to the AzureMonitor service tag.

Answer

To meet the requirements, you must recommend deploying a Private Endpoint for the Azure Storage account and configuring a Network Security Group (NSG) with an outbound rule allowing traffic to the AzureMonitor service tag.

Deploying a Private Endpoint for the storage account assigns it a private IP within the subnet, ensuring traffic does not traverse the public internet. Configuring an NSG outbound rule with the AzureMonitor service tag ensures that virtual machines can safely transmit logs to Azure Monitor while avoiding the administrative overhead of maintaining individual IP addresses.

Step-by-Step Solution

Analyze storage access requirements

Determine that private endpoint is needed to keep storage traffic off the public internet

Private Endpoints assign private IP addresses from the virtual network subnet to the Azure service, securing traffic and preventing public internet traversal.

Analyze monitoring requirements

Determine that NSG outbound rule must allow traffic to Azure Monitor using a service tag

Using service tags simplifies management because Microsoft automatically maintains the IP addresses within the tag, minimizing administrative effort compared to manually configuring individual IP ranges.

Evaluate and eliminate incorrect architectures

Discard solutions proposing manually managed IP rules, Basic/Standard SKU mixing, and invalid UDRs

Mixing basic/standard SKUs fails deployment validation, routing all traffic to a storage public IP is invalid, and manual IP rules violate the administrative overhead constraint.

Key Concept

Designing secure network access and private connectivity using Private Endpoints and NSG Service Tags to minimize administrative overhead.

Question 1055Question →

A construction engineering firm stores high-resolution CAD blueprints of completed projects in an Azure Blob Storage General-purpose v2 (GPv2) storage account. The blueprints are accessed frequently during the project delivery phase, which lasts for 90 days. For the next 270 days (up to day 360 total), the blueprints are accessed occasionally for maintenance requests. The firm's customer service agreement guarantees that blueprints must be available for download in less than 30 seconds. After 360 days, the blueprints must be retained for 10 years ( $3,650$ days) for regulatory audit compliance. During this audit phase, retrieval delays of up to 12 hours are acceptable. The company wants to minimize storage costs while meeting all access and retention requirements. Which of the following lifecycle management policies should you recommend?

Transition blobs to the Archive tier after 90 days, and delete blobs after 3650 days.

Transition blobs to the Archive tier after 90 days, transition blobs to the Cool tier after 360 days, and delete blobs after 3650 days.

Transition blobs to the Cool tier after 90 days, transition blobs to the Archive tier after 360 days, and delete blobs after 3650 days.

Transition blobs to the Cool tier after 90 days, and delete blobs after 3650 days without transitioning to the Archive tier.

Show answer & explanation

Answer: Transition blobs to the Cool tier after 90 days, transition blobs to the Archive tier after 360 days, and delete blobs after 3650 days.

Answer

Transition blobs to the Cool tier after 90 days, transition blobs to the Archive tier after 360 days, and delete blobs after 3650 days.

Transitioning the blobs to the Cool tier after 90 days matches the requirement for low-latency retrieval up to day 360 at a lower cost than the Hot tier. Moving them to the Archive tier after 360 days minimizes storage costs for the remaining retention period where up to 12 hours of retrieval delay is acceptable. Finally, deleting the blobs after 3,650 days satisfies the long-term retention compliance requirement.

Step-by-Step Solution

Analyze the access frequency and latency constraints for each phase.

Phase 1 (days 0-90): Frequent access, Hot tier (default). Phase 2 (days 91-360): Occasional access, sub-30 second retrieval required (requires online tier like Cool or Cold). Phase 3 (day 361-3650): Rare access, 12-hour latency acceptable (Archive tier is suitable).

Ensures the selected storage tiers meet the performance SLA of each lifecycle stage.

Evaluate the cost-effective transitions.

Transition to Cool tier after 90 days, then to Archive tier after 360 days.

Cool tier offers cheaper storage than Hot while maintaining millisecond retrieval times. Archive tier offers the lowest storage cost for the compliance phase where high retrieval latency is allowed.

Verify retention and deletion configuration.

Set deletion to occur after 3,650 days (

10

years) total.

Aligns the data deletion with the regulatory retention period.

Key Concept

Azure Blob Storage Lifecycle Management Tiers and Latency Constraints

Estimated Time:1m 30s

Question 1056Question →

An organization has a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` ( $10.200.0.0/16$ ), contains a Network Virtual Appliance (NVA) at IP address $10.200.1.4$ in a subnet named `snet-nva`. The spoke virtual network, `vnet-weur-spoke1` ( $10.201.0.0/16$ ), contains a subnet named `snet-app` ( $10.201.1.0/24$ ).

To meet security compliance, you associate a route table named `rt-spoke-app` with `snet-app`. The route table contains the following user-defined routes (UDRs):
* Route 1: Prefix $10.200.0.0/16$ , Next hop: Virtual Appliance ( $10.200.1.4$ )
* Route 2: Prefix $10.201.0.0/16$ , Next hop: Virtual Appliance ( $10.200.1.4$ )
* Route 3: Prefix $0.0.0.0/0$ , Next hop: Virtual Appliance ( $10.200.1.4$ )

After applying `rt-spoke-app`, virtual machines in `snet-app` cannot communicate with other virtual machines located in the same spoke virtual network, `vnet-weur-spoke1`.

You need to restore intra-spoke communication while ensuring that all internet-bound and hub-bound traffic continues to be routed through the NVA.

What should you do?

Remove the route with the

10.201.0.0/16

prefix from the route table.

Change the next hop type of the route with the

10.201.0.0/16

prefix to Virtual Network Gateway.

Change the address prefix of the route pointing to the NVA from

10.201.0.0/16

10.201.1.0/24

Associate a Network Security Group (NSG) to `snet-app` that contains individual inbound and outbound security rules for every virtual machine IP address in the spoke VNet instead of using Service Tags.

Show answer & explanation

Answer: Remove the route with the $10.201.0.0/16$ prefix from the route table.

Answer

Remove the route with the

10.201.0.0/16

prefix from the route table.

Removing the route with the

10.201.0.0/16

prefix allows the system-defined route for the local virtual network to take over. Azure automatically creates a system route for the local VNet address space with the next hop type 'Virtual Network'. Since User-Defined Routes (UDRs) override system routes for the same prefix, the custom route was forcing local traffic to the NVA. Removing this route restores local communication. The remaining routes for

10.200.0.0/16

and

0.0.0.0/0

ensure that hub-bound and internet-bound traffic continue to route through the NVA.

Step-by-Step Solution

Analyze the precedence of Azure routing tables and identify why intra-spoke communication failed.

Azure evaluates routes based on longest prefix match (LPM). However, User-Defined Routes (UDRs) always override system-defined routes of the same prefix. The custom route for

10.201.0.0/16

(Route 2) overrides the default system route for the local virtual network (next hop: Virtual Network).

Understanding why traffic is incorrectly redirected is the first step in troubleshooting virtual network routing.

Determine the impact of removing the custom route for

10.201.0.0/16

Removing the UDR for

10.201.0.0/16

allows the default system route for the local VNet to handle intra-spoke traffic, directing it straight to the local virtual network next hop without going to the NVA.

This restores local connectivity since local traffic no longer hairpins through the NVA.

Verify that the remaining requirements (routing hub-bound and internet-bound traffic through the NVA) are still met.

Traffic destined for the hub virtual network matches the UDR for

10.200.0.0/16

(Route 1), and internet-bound traffic matches the default UDR for

0.0.0.0/0

(Route 3). Both routes direct traffic to the NVA at

10.200.1.4

Ensures compliance with the security requirements while restoring local spoke traffic flow.

Key Concept

Azure routing priority and the override of local system routes by User-Defined Routes (UDRs).

Estimated Time:1m 30s

Question 1057Question →

An enterprise is designing a regional application delivery and load balancing solution in Azure. The architecture must support a multi-tier application with the following requirements:

1. Handle incoming HTTP/HTTPS traffic, perform SSL/TLS termination, and route requests to different backend pools based on the URL path (/orders/* and /products/*).
2. Load balance inbound TCP traffic on port 9090 across a pool of Azure Virtual Machines.
3. The virtual machines currently use Basic SKU public IP addresses for direct administrative access.
4. The load balancing components must support Availability Zones for high availability.

Which two actions should you include in the design to meet the requirements while preventing configuration failures? (Select two.)

Select all that apply

Deploy an Azure Application Gateway v2 to manage the URL path-based routing and SSL/TLS termination.

Deploy an Azure Standard Load Balancer to route the TCP traffic on port 9090, and upgrade the virtual machine public IP addresses to Standard SKU.

Deploy an Azure Basic Load Balancer to route the TCP traffic on port 9090, allowing the virtual machines to keep their existing Basic SKU public IP addresses.

Deploy Azure Traffic Manager to manage the incoming HTTP/HTTPS traffic, perform SSL/TLS termination, and route requests based on the URL path.

Configure the Azure Standard Load Balancer to perform URL path-based routing and SSL/TLS termination for the HTTP/HTTPS traffic.

Show answer & explanation

Answer: Deploy an Azure Application Gateway v2 to manage the URL path-based routing and SSL/TLS termination.; Deploy an Azure Standard Load Balancer to route the TCP traffic on port 9090, and upgrade the virtual machine public IP addresses to Standard SKU.

Answer

Deploying an Azure Application Gateway v2 to manage the URL path-based routing and SSL/TLS termination, and deploying an Azure Standard Load Balancer to route the TCP traffic on port 9090 while upgrading the virtual machine public IP addresses to Standard SKU.

Deploying an Azure Application Gateway v2 satisfies the requirement for Layer 7 load balancing, which includes URL path-based routing and SSL/TLS termination within a region, and supports availability zones. Since the backend virtual machines must also load balance Layer 4 TCP traffic on port 9090 with availability zone support, an Azure Standard Load Balancer is required. To prevent a SKU mismatch, any public IP addresses associated with the virtual machines in the Standard Load Balancer's backend pool must be upgraded from Basic to Standard SKU.

Step-by-Step Solution

Analyze the Layer 7 requirements for HTTP/HTTPS routing and SSL/TLS termination.

Determine that Azure Application Gateway v2 is required because it supports URL-based path routing (/orders/* and /products/*), handles SSL/TLS termination, and provides zone redundancy.

Layer 7 inspection is necessary for URL routing, and v2 SKUs are required for availability zones.

Analyze the Layer 4 requirements for TCP traffic load balancing.

Determine that an Azure Standard Load Balancer is required to route TCP traffic on port 9090 with zone-redundancy support.

Standard SKU is required for availability zone support at Layer 4.

Identify SKU compatibility constraints for public IP addresses on the virtual machines.

Determine that the existing Basic SKU public IP addresses on the virtual machines must be upgraded to Standard SKU.

Azure does not allow mixing Basic SKU public IPs with Standard SKU load balancers or backend configurations, which would cause validation failures.

Key Concept

Designing regional application delivery solutions requires selecting the correct load balancing tier (Layer 4 vs Layer 7) and ensuring all associated resources, including virtual machine public IPs and load balancer SKUs, match to prevent configuration and deployment failures.

Question 1058Question →

An enterprise is designing a global business continuity solution for a web application deployed in the East US and West US regions. The architecture must meet the following requirements:

- Route incoming HTTP/HTTPS requests to the region with the lowest latency.
- Provide automatic failover within 30 seconds if a regional endpoint becomes unhealthy.
- Support URL path-based routing (such as routing /images/* to a storage account and /api/* to web servers) at the global entry point.
- Avoid failover delays caused by client-side DNS caching or ISP DNS time-to-live (TTL) configurations.

Which traffic routing and failover service should you recommend?

Azure Traffic Manager configured with priority routing

Azure Cross-Region Load Balancer

Azure Front Door

Azure Application Gateway configured with a globally shared public IP address

Show answer & explanation

Answer: Azure Front Door

Answer

Azure Front Door

Azure Front Door is the correct choice because it is a global Layer 7 load balancer that uses Anycast DNS and splits TCP connections to route traffic to the closest healthy backend. Because it operates at Layer 7, it natively supports SSL offloading and URL path-based routing. Additionally, because failover occurs at the Anycast edge POPs rather than via client DNS updates, it avoids delays caused by client-side or ISP DNS caching, enabling failover in less than 30 seconds.

Step-by-Step Solution

Analyze the protocol and layer requirements of the workload.

The application requires HTTP/HTTPS routing, SSL offloading, and URL path-based routing, which are Layer 7 features.

This rules out Layer 4 routing options like Azure Cross-Region Load Balancer and DNS-based routing like Azure Traffic Manager.

Evaluate failover SLA and DNS caching constraints.

The solution must guarantee failover within 30 seconds and bypass client-side DNS caching.

Anycast-based routing (Azure Front Door) routes traffic directly to the nearest edge POP, where failover is handled immediately without waiting for client-side DNS record expiration.

Compare regional vs global scope of the remaining Layer 7 services.

Azure Front Door operates globally, whereas Azure Application Gateway is a regional service.

Since the application is deployed across East US and West US, a global load balancer like Azure Front Door is required to handle traffic distribution and failover.

Key Concept

Azure Front Door is a global Layer 7 load balancer that uses Anycast-based routing to provide low-latency routing, path-based routing, and fast failover that is immune to DNS caching issues.

Question 1059Question →

Zephyr Logistics is designing a secure hybrid networking architecture. The environment consists of an on-premises datacenter with local Active Directory DNS servers, an Azure subscription with a hub virtual network and a peered spoke virtual network, and an ExpressRoute connection linking the on-premises datacenter to the hub virtual network. Virtual machines (VMs) are deployed in a subnet named AppSubnet in the spoke virtual network to host a business-critical application that connects to an Azure SQL Database containing sensitive customer records.

The architecture must meet the following requirements:
- The Azure SQL Database must not be exposed to the public internet.
- The VMs in AppSubnet must connect to the database securely using the private IP address of the database.
- On-premises client machines must be able to resolve and query the database using the same fully qualified domain name (FQDN) as the Azure VMs.
- Administrative overhead for security rules and DNS management must be minimized.

Which two actions should you recommend to meet these requirements?

Select all that apply

Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, and link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network.

Configure an inbound endpoint on the Azure Private DNS Resolver in the hub virtual network, and configure the on-premises DNS servers to forward queries for database.windows.net to the private IP address of the inbound endpoint.

Configure a Network Security Group (NSG) on the spoke subnet with outbound security rules that target the individual public IP addresses of the Azure SQL Database gateway endpoints.

Create a route table with a User Defined Route (UDR) in the spoke subnet that routes all traffic destined for the SQL Database Private Endpoint IP address to the on-premises VPN gateway, overriding the default system routes.

Deploy a Standard Load Balancer in the spoke virtual network to distribute traffic to the SQL Database Private Endpoint, and associate virtual machines using Basic SKU public IP addresses to the load balancer backend pool.

Show answer & explanation

Answer: Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, and link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network.; Configure an inbound endpoint on the Azure Private DNS Resolver in the hub virtual network, and configure the on-premises DNS servers to forward queries for database.windows.net to the private IP address of the inbound endpoint.

Answer

Configure a Private Endpoint for the Azure SQL Database in the spoke virtual network, link the Azure Private DNS zone named privatelink.database.windows.net to the hub virtual network, and deploy an Azure Private DNS Resolver inbound endpoint in the hub virtual network while configuring conditional forwarding on the on-premises DNS servers.

The correct architecture requires establishing a Private Endpoint for the database to remove public internet exposure. Resolving the database FQDN from on-premises requires configuring an Azure Private DNS Resolver in the hub virtual network (where the ExpressRoute terminates) and creating a conditional forwarder on-premises pointing to the resolver's inbound endpoint. In addition, the Azure Private DNS zone must be linked to the hub virtual network so that the Private DNS Resolver can query and return the private IP address of the SQL Database.

Step-by-Step Solution

Isolate database traffic from the public internet by creating a Private Endpoint.

The Azure SQL Database is assigned a private IP address within the spoke virtual network, and its public endpoint is secured or disabled.

This satisfies the security requirement to restrict public internet exposure and ensures connection is made via private IP.

Link the Azure Private DNS zone to the hub virtual network.

The hub virtual network has access to the private DNS records configured for the Private Endpoint.

This allows the Azure Private DNS Resolver located in the hub virtual network to resolve the database private IP address.

Deploy an Azure Private DNS Resolver with an inbound endpoint in the hub virtual network and configure conditional forwarding on-premises.

On-premises DNS queries for database.windows.net are forwarded to the inbound endpoint, which queries the linked Private DNS Zone.

This enables on-premises clients to resolve the database FQDN to the Private Endpoint IP address without exposing the database publicly.

Key Concept

Azure Private Endpoint and Azure Private DNS Resolver integration for secure hybrid name resolution and private access.

Estimated Time:3m 0s

Question 1060Question →

An organization is designing a secure network environment for a batch processing workload running on Azure Virtual Machines inside a dedicated subnet. The virtual machines must connect to an Azure SQL Database and an Azure Key Vault to retrieve data and connection secrets. The security team requires that all outbound internet traffic from the subnet be blocked, except for the traffic destined for these two Azure services. The solution must minimize administrative overhead and ensure that network rules do not require manual updates when Microsoft changes the IP addresses of these services.

Which configuration should you recommend for the Network Security Group (NSG) associated with the subnet?

Create outbound security rules that allow traffic with the destination set to the SQL and AzureKeyVault Service Tags, and a lower-priority rule that denies all outbound traffic to the Internet Service Tag.

Create outbound security rules that allow traffic to the specific public IP address ranges of the regional Azure SQL Database and Azure Key Vault endpoints, and implement an automated script to verify and update the ranges monthly.

Associate a route table with custom User Defined Routes (UDRs) that override the default system routes to direct Azure SQL and Key Vault traffic through the default internet gateway.

Configure an outbound NAT rule on a Standard Load Balancer that routes the traffic using Basic SKU public IP addresses assigned directly to the virtual machines.

Show answer & explanation

Answer: Create outbound security rules that allow traffic with the destination set to the SQL and AzureKeyVault Service Tags, and a lower-priority rule that denies all outbound traffic to the Internet Service Tag.

Answer

The correct configuration is to use built-in Service Tags (SQL and AzureKeyVault) in the NSG outbound rules, followed by a rule blocking the Internet Service Tag. This allows outbound access only to the specified services and delegates the management of service IP addresses to Azure, satisfying the constraint of minimizing administrative effort.

Step-by-Step Solution

Identify the target services and security requirements.

The target services are Azure SQL Database and Azure Key Vault. Outbound internet traffic must be blocked except for connections to these two services.

This establishes the boundary conditions for the NSG rules.

Determine the optimal NSG destination settings to minimize administrative overhead.

Use the SQL and AzureKeyVault Service Tags as destinations rather than specific IP addresses.

Service Tags are managed by Microsoft and automatically update when IP addresses of Azure services change, eliminating manual updates.

Define the rule ordering and priorities within the NSG.

Create high-priority Allow rules for SQL and AzureKeyVault Service Tags, and a lower-priority Deny rule for the Internet Service Tag.

NSG rules are processed in priority order. Allowing specific services first before denying all internet traffic ensures the VMs can communicate with the required endpoints while blocking everything else.

Key Concept

Azure Network Security Group Service Tags allow you to define network access controls for Azure services without maintaining individual IP addresses.

PreviousPage 53 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept