All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

A shipping logistics company is designing an Azure compute solution for its new transit tracking application. The application consists of two main components:

1. Real-time Route Calculator: A stateful service that runs continuously to update delivery estimates. It requires stable, predictable CPU performance and must meet a strict service level agreement (SLA) for uptime.
2. Historical Analytics Processor: A processing job that runs nightly to analyze route efficiency. The job can be interrupted and resumed without impact, and minimizing compute cost is the highest priority.

Which of the following compute virtualization configurations should you recommend to meet these requirements? (Select TWO)

Select all that apply

Deploy the Real-time Route Calculator on standard on-demand Azure Virtual Machines.

Deploy the Historical Analytics Processor on Azure Spot Virtual Machines.

Deploy the Real-time Route Calculator on Azure Spot Virtual Machines to minimize baseline operational costs.

Deploy the Real-time Route Calculator instances within a single Azure Availability Zone to achieve high availability.

Show answer & explanation

Answer: Deploy the Real-time Route Calculator on standard on-demand Azure Virtual Machines.; Deploy the Historical Analytics Processor on Azure Spot Virtual Machines.

Answer

Deploy the Real-time Route Calculator on standard on-demand Azure Virtual Machines and deploy the Historical Analytics Processor on Azure Spot Virtual Machines.

Deploying the continuous, SLA-bound Real-time Route Calculator on standard on-demand VMs ensures stable, uninterrupted performance. Deploying the interruptible, cost-sensitive Historical Analytics Processor on Azure Spot VMs achieves the maximum cost savings while tolerating potential evictions.

Step-by-Step Solution

Analyze the requirements of the Real-time Route Calculator workload.

Identified that the workload runs continuously, requires stable CPU performance, and must meet a strict uptime SLA.

This workload requires standard on-demand Virtual Machines to prevent unexpected evictions and ensure predictable performance.

Analyze the requirements of the Historical Analytics Processor workload.

Identified that the workload is an interruptible nightly batch job where minimizing compute cost is the highest priority.

This workload is a perfect candidate for Azure Spot Virtual Machines, which offer deep discounts in exchange for accepting potential runtime evictions.

Evaluate the proposed configurations against best practices.

Confirms that standard on-demand VMs meet the SLA for the calculator service, and Spot VMs meet the cost requirements for the batch processor.

This configuration satisfies all technical requirements and business constraints without introducing availability risks to production or unnecessary costs.

Key Concept

Selecting appropriate VM purchase models (on-demand vs. Spot) and redundancy configurations based on workload SLA and cost requirements.

Question 1102Question →

A company named Aetheris Manufacturing is designing the network security architecture for a new web application. The application runs on Azure Virtual Machines deployed in a subnet named AppSubnet within a virtual network named VNet1. The application requires access to an Azure SQL Database and must retrieve configuration secrets from an Azure Key Vault. The application must also authenticate users using Microsoft Entra ID. You need to design a security solution that meets the following requirements:
- Restrict all outbound internet access from AppSubnet, except for the traffic required for Microsoft Entra ID authentication and Azure Key Vault access.
- Ensure the virtual machines access the Azure SQL Database using private IP addresses.
- Minimize the administrative and operational effort required to maintain network security rules.
- Avoid manually defining and updating public IP address ranges in network security rules.

Which two actions should you include in the design?

Select all that apply

Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1.

Associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.

Configure Virtual Network service endpoints for Microsoft Entra ID on AppSubnet.

Create custom outbound security rules in the Network Security Group (NSG) using the specific public IP address ranges for the Microsoft Entra ID and Azure Key Vault regional endpoints.

Deploy an Azure NAT Gateway on AppSubnet and configure it with custom filtering policies targeting Microsoft Entra ID and Azure Key Vault endpoints.

Show answer & explanation

Answer: Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1.; Associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.

Answer

Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1, and associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.

Deploying a Private Endpoint for the Azure SQL Database ensures that database traffic is kept entirely within the private network, satisfying the requirement to access it via private IP addresses. For the security rules, using the built-in AzureActiveDirectory and AzureKeyVault service tags within the Network Security Group (NSG) allows authentication and Key Vault traffic while blocking all other outbound internet traffic. This avoids manual IP list maintenance and fulfills the requirement to minimize administrative and operational effort.

Step-by-Step Solution

Analyze database connectivity requirements

Identify that a Private Endpoint is needed to assign a private IP address to the Azure SQL Database.

This satisfies the requirement to avoid exposing the database publicly and allows secure access via internal IPs.

Determine service access security parameters

Identify that Microsoft Entra ID and Azure Key Vault require outbound connectivity, which should be secured using built-in service tags rather than individual IP rules.

Service tags minimize administrative overhead by dynamically maintaining IP address ranges for Azure services.

Apply Network Security Group configurations

Associate the NSG to the application subnet, adding rules to allow AzureActiveDirectory and AzureKeyVault outbound traffic, followed by a lower-priority rule to deny outbound traffic to the Internet.

This configuration enforces the restriction of general internet access while maintaining operational access to key services.

Key Concept

Azure Private Endpoints and Network Security Group Service Tags

Question 1103Question →

An enterprise is modernizing a media streaming platform in Azure. The system consists of two primary endpoints:

1. A management API endpoint that receives HTTP/HTTPS control messages on port 443. The API requires URL path-based routing (e.g., `/stream/start` vs `/stream/stop`) and SSL/TLS termination.
2. A real-time video stream ingestion endpoint that receives continuous UDP traffic on port 8080.

The backend virtual machines (VMs) processing both workloads are deployed within a Virtual Machine Scale Set (VMSS) across multiple Availability Zones for high availability. To reduce costs, the networking team proposes deploying:

* An Azure Application Gateway (Standard v2) to load balance the HTTP/HTTPS management API.
* A Basic SKU Azure Load Balancer to load balance the UDP streaming traffic.

Why will the proposed load balancing configuration fail to deploy?

The proposed design must replace the Application Gateway with Azure Traffic Manager to perform the URL path-based routing and SSL/TLS termination at the global level.

The virtual machine scale set instances cannot be associated with both the Standard SKU Application Gateway and the Basic SKU Load Balancer backend pools simultaneously, as mixing Basic and Standard SKU load balancing resources on the same network interfaces is not supported.

The backend virtual machine scale set instances must be consolidated into a single Availability Zone because Application Gateway Standard v2 cannot distribute traffic to zone-redundant backend pools.

The configuration requires a custom User Defined Route (UDR) to redirect the UDP traffic through the Application Gateway subnet, which will override default system routes and cause a network routing loop.

Show answer & explanation

Answer: The virtual machine scale set instances cannot be associated with both the Standard SKU Application Gateway and the Basic SKU Load Balancer backend pools simultaneously, as mixing Basic and Standard SKU load balancing resources on the same network interfaces is not supported.

Answer

The correct answer states that the virtual machine scale set instances cannot belong to both a Standard SKU resource (Application Gateway v2) and a Basic SKU Load Balancer backend pool at the same time. Azure enforces strict SKU isolation at the network interface (NIC) level, meaning all load balancers or application gateways attached to a VM's NIC must share the same SKU level (Standard or Basic). Mixing SKUs results in deployment validation failures.

Step-by-Step Solution

Analyze the protocol and routing requirements for both endpoints.

The management API requires Layer 7 routing (HTTP/HTTPS, path-based routing, SSL termination), making Azure Application Gateway appropriate. The streaming ingest requires Layer 4 routing (UDP on port 8080), which requires Azure Load Balancer.

Application Gateway does not support UDP traffic, necessitating a separate Layer 4 load balancer.

Assess the SKU compatibility rules for Azure Load Balancer and Application Gateway.

Application Gateway Standard v2 functions as a Standard SKU resource. The proposed Load Balancer is a Basic SKU resource. Registering the same virtual machine network interfaces to backend pools of different SKUs violates SKU isolation policies.

Azure prevents registering a network interface card (NIC) to a mix of Basic and Standard SKU load balancing resources.

Identify the necessary remediation steps.

Upgrade the Basic SKU Load Balancer to a Standard SKU Load Balancer.

Using a Standard Load Balancer aligns the SKU level with the Application Gateway Standard v2, resolving the validation failure while supporting the zone-redundant backend VM configuration.

Key Concept

Load Balancer SKU compatibility and co-existence constraints

Estimated Time:2m 30s

Question 1104Question →

A media streaming company is designing the compute layer for a real-time video transcoding service that runs on Azure Virtual Machines. The service must meet the following requirements:
- The virtual machines must achieve a compute SLA of at least $99.95\%$ for high availability.
- The virtual machines must be placed to ensure the lowest possible network latency between the instances.
- The virtual machines must be protected against localized hardware failures, such as power or cooling issues within a single physical rack.

Which two actions should you include in the design to meet the requirements? (Select two.)

Select all that apply

Deploy the virtual machines in an Availability Set.

Create a Proximity Placement Group and associate it with the virtual machines.

Deploy the virtual machines across multiple Availability Zones.

Deploy all virtual machines within a single Availability Zone without utilizing any availability constructs.

Show answer & explanation

Answer: Deploy the virtual machines in an Availability Set.; Create a Proximity Placement Group and associate it with the virtual machines.

Answer

Deploy the virtual machines in an Availability Set and associate them with a Proximity Placement Group.

Deploying the virtual machines in an Availability Set ensures they are distributed across separate physical hardware racks (fault domains) within a single data center, providing protection against rack-level failures and meeting the

99.95\%

SLA. Associating the virtual machines with a Proximity Placement Group guarantees that the host servers are physically close to each other, minimizing network latency.

Step-by-Step Solution

Analyze high availability and SLA constraints.

The transcoding service requires a

99.95\%

SLA and protection against single-rack hardware failures.

This establishes that we must deploy the virtual machines using a construct that spans multiple fault domains.

Analyze network latency requirements.

The transcoding service requires the lowest possible network latency between virtual machines.

This restricts the physical placement of the virtual machines to a single data center, ruling out cross-zone solutions which introduce network latency.

Select the correct combination of Azure features.

Deploying the virtual machines in an Availability Set provides the

99.95\%

SLA and rack isolation, and placing them in a Proximity Placement Group ensures they are physically colocated to minimize latency.

This combination successfully meets all high availability, rack protection, and low latency requirements.

Key Concept

Designing compute high availability with low-latency placement constraints using Availability Sets and Proximity Placement Groups in Azure.

Estimated Time:1m 30s

Question 1105Question →

A company plans to migrate its on-premises environment to Azure. The environment consists of ten virtual machines running on a Nutanix AHV cluster, four physical servers running Oracle Solaris, and a Microsoft SQL Server 2016 failover cluster instance hosting databases that utilize cross-database queries. You need to design a migration assessment and dependency mapping strategy. The strategy must discover all server workloads, assess their readiness, identify all network and application dependencies, and identify the correct database migration target while preserving database features. Which two actions should you include in the strategy? Choose two.

Select all that apply

Deploy the Azure Migrate appliance configured for physical or other servers to discover the Nutanix AHV virtual machines.

Install the Dependency agent and the Log Analytics agent on the Solaris servers and Nutanix AHV virtual machines.

Enable agentless dependency analysis in the Azure Migrate project settings for the discovered Nutanix AHV virtual machines.

Recommend Azure SQL Database elastic pools as the target migration tier for the SQL Server databases.

Configure Active Directory Federation Services (AD FS) to synchronize user identities from the on-premises environment to Microsoft Entra ID prior to the assessment.

Show answer & explanation

Answer: Deploy the Azure Migrate appliance configured for physical or other servers to discover the Nutanix AHV virtual machines.; Install the Dependency agent and the Log Analytics agent on the Solaris servers and Nutanix AHV virtual machines.

Answer

Deploy the Azure Migrate appliance configured for physical or other servers to discover the Nutanix AHV virtual machines, and install the Dependency agent and the Log Analytics agent on the Solaris servers and Nutanix AHV virtual machines.

Deploying the Azure Migrate appliance configured for physical or other servers is correct because Azure Migrate does not have native hypervisor-level integration for Nutanix AHV; therefore, these workloads must be discovered and assessed using the physical server workflow. Installing the Dependency agent and Log Analytics agent is correct because agentless dependency analysis is only supported for VMware and Hyper-V virtual machines. For physical servers and other hypervisors, agent-based dependency mapping is required to visualize network connections.

Step-by-Step Solution

Determine the discovery method for Nutanix AHV workloads.

Identify that because Azure Migrate lacks native hypervisor integration for Nutanix AHV, these virtual machines must be discovered using the physical server discovery workflow via the Azure Migrate appliance.

This allows successful discovery and inventory collection of the Nutanix AHV VMs.

Determine the dependency analysis method for physical and Nutanix AHV servers.

Determine that agentless dependency mapping is not supported for physical or other non-VMware/Hyper-V platforms, requiring the deployment of the Dependency agent and Log Analytics agent.

Agent-based dependency mapping is mandatory for physical servers and Nutanix AHV to capture application connections.

Evaluate the database tier requirements based on cross-database queries.

Rule out Azure SQL Database elastic pools and single databases, confirming that Azure SQL Managed Instance is the minimal relational database tier that supports cross-database queries.

Ensures feature parity and legacy application compatibility without rewriting queries.

Key Concept

Designing migration discovery, dependency mapping, and relational database targeting based on platform compatibility and technical limitations.

Question 1106Question →

A retail company is designing a serverless architecture for a new inventory management system. The architecture must support two workloads:

1. A public-facing REST API that serves product catalog details, which experiences unpredictable traffic spikes and must minimize costs by scaling to zero during idle periods.
2. A nightly batch synchronization job that updates inventory levels from an external warehouse database, which runs to completion, takes up to 45 minutes to execute, and requires a custom runtime environment.

To minimize administrative overhead and runtime hosting costs, which hosting configuration should you recommend?

Azure Functions on a Consumption plan to host the REST API, and Azure Container Apps Jobs to run the nightly synchronization job

Azure Functions on a Consumption plan to host both the REST API and the nightly synchronization job

Azure Kubernetes Service (AKS) to host both the REST API and the nightly synchronization job as containerized workloads

Azure Functions on a Consumption plan for the REST API, and Azure Functions on a Consumption plan with the host.json timeout set to 60 minutes for the nightly synchronization job

Show answer & explanation

Answer: Azure Functions on a Consumption plan to host the REST API, and Azure Container Apps Jobs to run the nightly synchronization job

Answer

Azure Functions on a Consumption plan to host the REST API, and Azure Container Apps Jobs to run the nightly synchronization job

The correct architecture uses Azure Functions on a Consumption plan for the REST API, as it scales to zero during idle periods and scales out automatically to handle unpredictable traffic spikes. For the nightly synchronization job, Azure Container Apps Jobs is the optimal choice because it is designed for run-to-completion tasks, allows executions up to 24 hours, scales to zero when not running, and requires low administrative management compared to hosting Kubernetes clusters.

Step-by-Step Solution

Analyze the scaling and cost requirements for the REST API workload.

The REST API requires rapid scaling to handle traffic spikes and the ability to scale to zero to minimize idle hosting costs. Azure Functions on a Consumption plan perfectly matches these requirements.

Azure Functions Consumption plan is billed only when functions are running and scales automatically based on incoming events.

Evaluate the constraints of the nightly synchronization job.

The synchronization job runs for up to 45 minutes and is a run-to-completion batch task.

This duration exceeds the 10-minute maximum execution limit of the Azure Functions Consumption plan, ruling it out.

Select the optimal hosting option for the long-running batch job that minimizes costs and administrative overhead.

Azure Container Apps Jobs is designed specifically for transient, run-to-completion tasks, can run up to 24 hours, and charges only for the duration of execution, meaning zero baseline costs when idle.

Unlike AKS, which requires significant cluster management, or Dedicated/Premium App Service plans, which incur constant baseline costs even when idle, Azure Container Apps Jobs provides a serverless model with minimal administrative overhead.

Key Concept

Selecting appropriate serverless hosting options based on execution time limits, scaling characteristics, and operational overhead.

Question 1107Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-central`, uses the IP address space $10.10.0.0/16$ and hosts an Azure Firewall at $10.10.1.4$ . There are two spoke virtual networks: `vnet-app-prod` ( $10.20.0.0/16$ ) and `vnet-db-prod` ( $10.30.0.0/16$ ). Both spokes are peered directly to `vnet-hub-central`. You need to ensure that all network traffic between `vnet-app-prod` and `vnet-db-prod` is routed through the Azure Firewall for security inspection, while ensuring that resources within `vnet-app-prod` can communicate with each other directly without routing local traffic through the firewall. Which two configurations should you implement? (Select two.)

Select all that apply

A route table associated with the subnet in `vnet-app-prod` that contains a route for

10.30.0.0/16

with a next hop of Virtual Appliance pointing to

10.10.1.4

A route table associated with the subnet in `vnet-db-prod` that contains a route for

10.20.0.0/16

with a next hop of Virtual Appliance pointing to

10.10.1.4

A route table associated with the subnet in `vnet-app-prod` that contains a route for

10.20.0.0/16

with a next hop of Virtual Appliance pointing to

10.10.1.4

A route table associated with the subnet in `vnet-db-prod` that contains a route for

10.30.0.0/16

with a next hop of Virtual Appliance pointing to

10.10.1.4

Show answer & explanation

Answer: A route table associated with the subnet in `vnet-app-prod` that contains a route for $10.30.0.0/16$ with a next hop of Virtual Appliance pointing to $10.10.1.4$ ; A route table associated with the subnet in `vnet-db-prod` that contains a route for $10.20.0.0/16$ with a next hop of Virtual Appliance pointing to $10.10.1.4$

Answer

Configure a route table associated with the subnet in the application spoke VNet with a route for the database spoke prefix pointing to the Azure Firewall, and configure another route table associated with the subnet in the database spoke VNet with a route for the application spoke prefix pointing to the Azure Firewall.

The correct solution involves configuring specific route tables in each spoke VNet to direct traffic destined for the opposite spoke VNet to the Azure Firewall's private IP address. By targeting only the remote spoke's IP space (

10.30.0.0/16

for the application spoke, and

10.20.0.0/16

for the database spoke), traffic destined for the other spoke is successfully routed to the firewall, while traffic within the local spoke continues to use the default system Local route.

Step-by-Step Solution

Identify the routing path requirements between spokes.

Traffic from the application spoke (

10.20.0.0/16

) destined for the database spoke (

10.30.0.0/16

) must transit the firewall (

10.10.1.4

) in the hub VNet (

10.10.0.0/16

This establishes security inspection requirements for cross-spoke communication.

Define the user-defined route for the application spoke subnet.

Add a UDR for destination

10.30.0.0/16

with a next hop of Virtual Appliance (

10.10.1.4

This overrides the default direct peering routing and forces traffic outbound to the database spoke to flow through the firewall.

Define the user-defined route for the database spoke subnet.

Add a UDR for destination

10.20.0.0/16

with a next hop of Virtual Appliance (

10.10.1.4

This ensures symmetric routing, allowing the response traffic from the database spoke to return through the firewall.

Verify local subnet routing behavior.

Ensure no UDRs are created targeting the local VNet's own CIDR block (i.e., do not configure

10.20.0.0/16

in the application spoke, or

10.30.0.0/16

in the database spoke).

This prevents overriding the default local system route, maintaining direct and unhindered internal communication within the spoke VNets.

Key Concept

Azure Virtual Network Peering and User Defined Routes (UDRs)

Estimated Time:1m 30s

Question 1108Question →

A financial services company is designing the Azure compute virtualization solution for a new core payment processing application. The application will run continuously ( $24/7$ ) and requires a highly available infrastructure with a $99.99\%$ SLA. Due to strict regulatory compliance, the application must run on isolated physical hardware dedicated to the company, and the virtual machines require a high memory-to-vCPU ratio to support caching massive transaction tables. Which compute solution should you recommend to meet these requirements?

Azure Dedicated Hosts running Esv5-series Virtual Machines deployed across multiple Availability Zones

Azure Spot Virtual Machines running Esv5-series on Azure Dedicated Hosts to minimize compute costs

Esv5-series Virtual Machines deployed in a single Availability Zone using a Virtual Machine Scale Set

An Azure Kubernetes Service (AKS) cluster using Esv5-series Virtual Machines on Azure Dedicated Hosts

Show answer & explanation

Answer: Azure Dedicated Hosts running Esv5-series Virtual Machines deployed across multiple Availability Zones

Answer

Azure Dedicated Hosts running Esv5-series Virtual Machines deployed across multiple Availability Zones

The correct option is the deployment of Azure Dedicated Hosts running Esv5-series Virtual Machines across multiple Availability Zones. This combination satisfies all criteria: Azure Dedicated Hosts ensure physical isolation at the hardware host level to meet compliance; Esv5-series VMs are memory-optimized, offering the high memory-to-vCPU ratio required for in-memory caching; and utilizing multiple Availability Zones ensures the resilience needed to meet the high availability SLA.

Step-by-Step Solution

Analyze the isolation requirement

The requirement for isolated physical hardware dedicated to the company points to Azure Dedicated Hosts.

Azure Dedicated Hosts provide physical servers dedicated to a single Azure subscription, satisfying strict physical isolation and regulatory requirements.

Analyze the workload characteristics and sizing requirements

The requirement for a high memory-to-vCPU ratio for caching transaction tables points to memory-optimized virtual machine families, such as the Esv5-series.

Esv5-series virtual machines are memory-optimized and provide a high memory-to-vCPU ratio, unlike general-purpose or storage-optimized series.

Analyze the availability and continuity requirements

The

24/7

continuous operation and

99.99\%

SLA require deploying across multiple Availability Zones and avoiding Spot VMs.

Spot VMs are subject to eviction and do not support SLAs, while deploying in a single zone exposes the application to zone-level failures, preventing the team from meeting the

99.99\%

SLA.

Key Concept

Selecting Azure compute hosting options, virtual machine families, and availability configurations based on compliance, performance, and SLA constraints.

Question 1109Question →

You are conducting an architectural review for a smart city traffic monitoring system. The system requires two primary workloads to be hosted in Azure:

1. A public API endpoint for transit queries that experiences severe traffic spikes during rush hours and long periods of inactivity overnight. To optimize cost, it must scale to zero instances when idle.
2. A background analytics worker that processes traffic camera footage. Each execution is triggered by a file upload, runs a custom computer vision model, and takes up to 20 minutes to complete.

To meet these requirements with the lowest operational overhead and cost, which two components should you include in your design? (Select TWO.)

Select all that apply

Azure Container Apps to host the public API endpoint

Azure Container Apps Jobs to run the background analytics worker

Azure Functions on a Consumption plan to run the background analytics worker

Azure Kubernetes Service (AKS) to host the public API endpoint

Show answer & explanation

Answer: Azure Container Apps to host the public API endpoint; Azure Container Apps Jobs to run the background analytics worker

Answer

Azure Container Apps to host the public API endpoint and Azure Container Apps Jobs to run the background analytics worker.

Azure Container Apps is the optimal solution for the public API endpoint because it supports automatic scaling down to zero instances when there is no traffic, effectively reducing costs during inactive hours. Azure Container Apps Jobs is the correct solution for the background analytics worker because it provides containerized execution for run-to-completion, event-triggered tasks without being restricted by the 10-minute execution limit that applies to standard Azure Functions Consumption plans.

Step-by-Step Solution

Analyze the scaling and cost requirements of the public API endpoint.

The API endpoint requires scale-to-zero capabilities to minimize idle costs and must handle spiky traffic, pointing to Azure Container Apps as the optimal low-overhead hosting choice.

Azure Container Apps natively supports scaling to zero based on HTTP traffic using KEDA, avoiding the operational complexity of Azure Kubernetes Service (AKS).

Evaluate the execution time constraint of the background analytics worker.

The worker runs for up to 20 minutes per execution, which exceeds the maximum execution timeout of 10 minutes for Azure Functions on a Consumption plan.

Choosing Azure Functions on a Consumption plan would lead to timeout failures, making Azure Container Apps Jobs the correct choice for run-to-completion tasks that exceed standard serverless timeouts.

Key Concept

Designing serverless hosting solutions requires balancing execution time limits (such as the 10-minute timeout of Azure Functions Consumption plans) against scaling requirements (such as scale-to-zero capabilities) and operational complexity.

Question 1110Question →

An organization plans to migrate a legacy three-tier web application hosted on-premises on a Hyper-V failover cluster to Azure. The application database tier consists of two Microsoft SQL Server virtual machines that execute cross-database queries. The application tier has strict low-latency requirements for database communication. The company wants to implement Microsoft Entra ID for hybrid identity but does not have any regulatory or technical requirements for federated authentication methods.

Which two actions should you include in the migration assessment and strategy? (Choose two.)

Select all that apply

Configure agentless or agent-based dependency analysis in Azure Migrate to identify network communication patterns and group dependent servers.

Recommend Azure SQL Managed Instance as the migration target for the database servers to support the cross-database queries.

Deploy on-premises Active Directory Federation Services (AD FS) to establish identity federation with Microsoft Entra ID.

Group the virtual machines into migration waves based solely on server name prefixes to accelerate the migration timeline.

Migrate the database servers to individual Azure SQL Database single databases using the Serverless compute tier.

Show answer & explanation

Answer: Configure agentless or agent-based dependency analysis in Azure Migrate to identify network communication patterns and group dependent servers.; Recommend Azure SQL Managed Instance as the migration target for the database servers to support the cross-database queries.

Answer

Configure agentless or agent-based dependency analysis in Azure Migrate to identify network communication patterns and group dependent servers, and recommend Azure SQL Managed Instance as the migration target for the database servers to support the cross-database queries.

The correct strategy requires performing dependency analysis to map server relationships and support low-latency grouping, while choosing Azure SQL Managed Instance to support cross-database queries.

Step-by-Step Solution

Analyze database compatibility requirements.

Identify that the database requires cross-database queries, ruling out Azure SQL Database single databases and directing the choice to Azure SQL Managed Instance.

Ensures the application's query features function correctly in Azure without requiring code refactoring.

Analyze database connectivity and latency requirements.

Identify that the multi-tier application needs low latency and has database dependencies, requiring dependency analysis mapping.

Allows grouping dependent virtual machines into the same migration wave to prevent latency issues.

Evaluate hybrid identity requirements.

Confirm that there are no technical or regulatory reasons requiring federation.

Avoids the deployment of AD FS, which carries high maintenance and overhead.

Key Concept

Identifying database compatibility features and network dependencies is critical to designing a successful Azure migration assessment and strategy.

Estimated Time:2m 0s

Question 1111Question →

An enterprise is modernizing a legacy web application in a single Azure region. The application requires routing incoming HTTP/HTTPS traffic to different virtual machine scale sets based on the URL path (such as routing `/api/*` to a dedicated API pool and `/web/*` to a web pool). The design must support SSL/TLS termination at the load balancing tier to offload decryption overhead from the backend instances. Additionally, administrative access to individual virtual machines must be preserved via Basic SKU Public IP addresses currently assigned directly to their network interfaces, and the load balancing solution must be restricted to regional distribution within the primary virtual network. Which of the following configuration options should the architect recommend?

Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.

Deploy an Azure Standard Load Balancer and add the network interfaces of the virtual machines to the backend pool while retaining their Basic SKU Public IPs.

Deploy Azure Traffic Manager to distribute the incoming traffic and configure SSL termination and path-based routing rules.

Deploy Azure Front Door and configure routing rules to direct public HTTP/HTTPS requests to the Basic SKU Public IP addresses of the virtual machines.

Show answer & explanation

Answer: Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.

Answer

Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.

The correct option is the deployment of Azure Application Gateway (Standard v2) targeting the backend VMs' private IP addresses. Application Gateway is a regional Layer 7 load balancer that natively supports SSL/TLS termination and URL path-based routing. By configuring the backend pool to target the VMs' private IP addresses within the virtual network, the design remains regional and avoids SKU mismatch conflicts that occur when mixing Basic SKU public IPs with Standard SKU public load balancers.

Step-by-Step Solution

Analyze the load balancing protocol and routing requirements.

The requirements specify URL-based routing (`/api/*` and `/web/*`) and SSL/TLS termination, which necessitates a Layer 7 load balancing solution (Azure Application Gateway or Azure Front Door). Layer 4 options like Azure Load Balancer are eliminated.

URL path-based routing and SSL termination require inspection and termination of the HTTP/HTTPS sessions at the load balancer level.

Analyze the geographic and networking requirements.

The solution must be restricted to regional distribution within a single Azure region and integrated within the primary virtual network. This eliminates Azure Front Door, which is a global service.

Azure Application Gateway operates regionally within a virtual network subnet, satisfying the regional routing constraint.

Evaluate SKU compatibility and backend integration for the virtual machines.

The backend virtual machines utilize Basic SKU Public IPs on their NICs. Standard Load Balancer backend pools require Standard SKU IPs if public IPs are used, but Application Gateway can target the private IP addresses of the VMs within the VNet, avoiding any SKU validation errors.

Targeting private IPs prevents the mixing of Basic and Standard SKUs on the public-facing components of the load balancer architecture.

Key Concept

Azure Application Gateway provides regional Layer 7 load balancing, SSL offloading, and URL path-based routing while integrating with backends via private IP addresses to avoid SKU mismatch conflicts.

Question 1112Question →

A legal services company is implementing a serverless worker that compiles large case files into a single PDF document. The compilation process is CPU-intensive and typically runs for 11 to 14 minutes per request. The company wants a fully managed serverless compute option that scales to zero to minimize costs during periods of inactivity, and they want to avoid the administrative overhead of managing underlying container clusters or virtual machines. Which Azure service should you select to meet these requirements?

Azure Functions on a Consumption plan

Azure Container Apps Jobs

Azure Kubernetes Service (AKS) cluster

Azure Virtual Machines using Spot Instances

Show answer & explanation

Answer: Azure Container Apps Jobs

Answer

Azure Container Apps Jobs

Azure Container Apps Jobs are ideal for run-to-completion tasks that require containerized environments without the complexity of AKS. They support execution times beyond 10 minutes, trigger dynamically on events or schedules, scale to zero when idle to save costs, and are fully managed by Azure.

Step-by-Step Solution

Analyze the execution duration requirement.

The compilation runs for 11 to 14 minutes, which is longer than the 10-minute maximum limit of the standard serverless execution environment of Azure Functions on a Consumption plan.

Identifying runtime requirements helps prevent execution timeouts.

Evaluate administrative and management overhead limits.

The requirement specifies avoiding cluster or virtual machine management, ruling out self-managed solutions.

Choosing a fully managed service satisfies the operational overhead constraints.

Match the workload type to the optimal serverless execution model.

Azure Container Apps Jobs support long-running, event-triggered tasks that scale to zero, meeting all criteria.

Selecting the service designed for run-to-completion containerized tasks ensures reliability and cost-efficiency.

Key Concept

Selecting serverless hosting options based on execution limits and management overhead constraints.

Question 1113Question →

Solaria Energy is designing a secure architecture for a cloud-based analytics system. The system consists of a virtual network named VNet-Analytics containing a subnet named Processing-Subnet. Virtual machines in Processing-Subnet must securely access an Azure SQL Database instance and an Azure Key Vault.

The design must meet the following requirements:
- All traffic to Azure SQL Database and Azure Key Vault must remain within the Microsoft backbone network.
- Virtual machines in Processing-Subnet must resolve the database and key vault hostnames using their private IP addresses.
- Public endpoint access to the Azure SQL Database and Azure Key Vault must be fully disabled.
- The solution must minimize administrative overhead.

Which two actions should you include in the design to meet the requirements?

Select all that apply

Create a private endpoint for the Azure SQL Database and a private endpoint for the Azure Key Vault.

Configure a private DNS zone named privatelink.database.windows.net and a private DNS zone named privatelink.vaultcore.azure.net, and link both zones to VNet-Analytics.

Configure Network Security Group (NSG) outbound rules allowing traffic to the individual public IP addresses of the Azure SQL Database and Azure Key Vault.

Create a User Defined Route (UDR) in Processing-Subnet that routes all traffic destined for the SQL Database and Key Vault to the virtual network's default gateway.

Show answer & explanation

Answer: Create a private endpoint for the Azure SQL Database and a private endpoint for the Azure Key Vault.; Configure a private DNS zone named privatelink.database.windows.net and a private DNS zone named privatelink.vaultcore.azure.net, and link both zones to VNet-Analytics.

Answer

Create a private endpoint for each service and configure the corresponding private DNS zones linked to the virtual network.

The correct architecture requires creating a private endpoint for the Azure SQL Database and another for the Azure Key Vault. This exposes them via private IPs on the virtual network and allows disabling public access. Additionally, the corresponding Azure Private DNS zones (privatelink.database.windows.net and privatelink.vaultcore.azure.net) must be configured and linked to the virtual network to ensure the virtual machines resolve the service hostnames to their private IP addresses.

Step-by-Step Solution

Identify the private access method that keeps traffic on the Microsoft backbone and allows disabling public endpoints.

Determine that Azure Private Endpoints (Private Link) must be deployed for both Azure SQL Database and Azure Key Vault.

Private Endpoints secure the services by bringing them into the virtual network via private IP addresses, fulfilling the network isolation and security requirements.

Determine the DNS configuration required for the services to resolve to their private endpoints.

Identify that privatelink.database.windows.net and privatelink.vaultcore.azure.net private DNS zones must be created and linked to the virtual network.

Without these specific private DNS zones linked to the VNet, the virtual machines would resolve the public IP addresses of the services instead of their private IP addresses, failing name resolution requirements.

Evaluate alternative methods to ensure they do not introduce unnecessary administrative overhead or break system routes.

Reject manual IP routing and custom route tables (UDRs) that override system routes, as well as manually maintaining lists of IP addresses in NSG rules.

Custom routes can conflict with system routes automatically created for private endpoints, and manual IP rules in NSGs fail to keep traffic secure and introduce excessive administrative overhead.

Key Concept

Private Endpoints and Private DNS Zone Integration

Question 1114Question →

An enterprise is designing a routing architecture in Azure. The topology consists of the following components:

* A hub virtual network named `vnet-hub-eus` ( $10.100.0.0/16$ ) that hosts a security Network Virtual Appliance (NVA) at $10.100.1.4$ .
* A spoke virtual network named `vnet-prod-eus` ( $10.110.0.0/16$ ) containing two subnets: `subnet-app` ( $10.110.1.0/24$ ) and `subnet-db` ( $10.110.2.0/24$ ).
* Virtual network peering is established between `vnet-hub-eus` and `vnet-prod-eus` with gateway transit disabled.

The design requires that all traffic from `vnet-prod-eus` to the Internet is routed through the NVA in `vnet-hub-eus` for inspection. However, to minimize latency and costs, traffic between `subnet-app` and `subnet-db` must route directly within the virtual network, bypassing the NVA.

To implement this, an administrator plans to associate a route table with both `subnet-app` and `subnet-db`.

Which route configuration should the administrator define in the route table to satisfy the requirements?

A single route with the address prefix

0.0.0.0/0

and the next hop type set to Virtual appliance pointing to

10.100.1.4

A route with the address prefix

0.0.0.0/0

pointing to

10.100.1.4

as a Virtual appliance, and a route with the address prefix

10.110.0.0/16

pointing to

10.100.1.4

as a Virtual appliance

A route with the address prefix

0.0.0.0/0

pointing to

10.100.1.4

as a Virtual appliance, and two separate routes with the address prefixes

10.110.1.0/24

and

10.110.2.0/24

pointing to the next hop type of Virtual network

A single route with the address prefix

0.0.0.0/0

and the next hop type set to Virtual network gateway

Show answer & explanation

Answer: A single route with the address prefix $0.0.0.0/0$ and the next hop type set to Virtual appliance pointing to $10.100.1.4$

Answer

A single route with the address prefix

0.0.0.0/0

and the next hop type set to Virtual appliance pointing to

10.100.1.4

The correct configuration is to define a single route with the address prefix

0.0.0.0/0

and the next hop type set to Virtual appliance pointing to the NVA's IP address. By default, Azure automatically creates system routes for all subnets in a virtual network. The system route for the local virtual network has the prefix

10.110.0.0/16

with the next hop type set to Virtual network. Under Azure's longest prefix match (LPM) algorithm, any traffic destined for another subnet within the same virtual network (such as from `subnet-app` to `subnet-db`) matches the more specific system route (

10.110.0.0/16

) rather than the default route (

0.0.0.0/0

). Therefore, intra-VNet traffic bypasses the NVA and is routed directly, while all internet-bound traffic (

0.0.0.0/0

) is routed to the NVA.

Step-by-Step Solution

Analyze default system routes in Azure Virtual Networks.

Azure automatically creates a system route for the virtual network prefix (

10.110.0.0/16

) with the next hop set to Virtual network. This route directs traffic between all subnets in the VNet.

Understanding default system routes is necessary to determine how custom routes will interact with standard intra-VNet traffic.

Apply the Longest Prefix Match (LPM) rule.

When a packet is routed, Azure compares the destination IP to all routes in the route table and chooses the route with the longest (most specific) prefix match.

LPM determines which route wins when multiple routes overlap, such as a default route (

0.0.0.0/0

) and a local VNet prefix (

10.110.0.0/16

Evaluate the custom default route configuration.

Adding a UDR for

0.0.0.0/0

pointing to the NVA handles all external/internet traffic. Because the local VNet prefix (

10.110.0.0/16

) is more specific than

0.0.0.0/0

, traffic between the subnets continues to use the system route directly without routing through the NVA.

This satisfies both requirements: internet traffic is inspected by the NVA, while intra-VNet traffic bypasses the NVA without needing redundant rules.

Key Concept

Azure Route Selection and Longest Prefix Match (LPM)

Question 1115Question →

An organization plans to migrate an on-premises payroll application hosted on VMware vSphere. The application comprises three web servers and a backend database server running SQL Server 2016. The database uses SQL Server Agent for scheduled maintenance and performs cross-database queries. Users authenticate via an on-premises Active Directory Domain Services (AD DS) domain. The application interacts with external services, but the specific network connections are undocumented.

You need to design a migration assessment and transition strategy that meets the following requirements:
- Identify all application network dependencies before migration to prevent service disruptions.
- Minimize administrative overhead and infrastructure complexity for both the database tier and identity synchronization.
- Maintain support for the legacy database features.

Which migration strategy should you recommend?

Establish migration groups based on server names without performing dependency mapping; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Database; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Active Directory Federation Services (AD FS).

Show answer & explanation

Answer: Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Answer

Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

The correct strategy uses agentless dependency analysis to map undocumented connections prior to migration. It deploys Azure SQL Managed Instance to preserve legacy features like SQL Server Agent and cross-database queries. It also configures Password Hash Synchronization (PHS) to keep the identity model simple and low-overhead.

Step-by-Step Solution

Determine dependency assessment requirements.

Since the network connections to external services are undocumented, performing dependency analysis is required to prevent post-migration connection failures.

This satisfies the requirement to identify all application dependencies before migration.

Evaluate the database tier compatible with SQL Server Agent and cross-database queries.

Azure SQL Managed Instance is chosen because it offers near-complete compatibility with SQL Server, supporting SQL Server Agent and cross-database queries natively.

Azure SQL Database single database does not support these features natively.

Evaluate hybrid identity options based on administrative and infrastructure overhead.

Password Hash Synchronization (PHS) is selected as it meets the synchronization requirement while requiring the least on-premises infrastructure and administrative effort.

Active Directory Federation Services (AD FS) requires deploying and maintaining federation servers and web application proxies, increasing complexity without a stated business justification.

Key Concept

Selecting target service tiers and assessment methods based on dependency requirements, database compatibility, and overhead constraints.

Question 1116Question →

An investment bank is designing the compute infrastructure for a core ledger processing system on Azure. The system must meet a virtual machine uptime SLA of 99.99% and must remain available even if an entire Azure zone experiences an outage. Which two configurations should you include in the design?

Select all that apply

Deploy the virtual machines across two or more Availability Zones in the region.

Use a Standard Load Balancer to distribute traffic to the virtual machines.

Deploy the virtual machines within a single Availability Zone using a single Availability Set.

Deploy the virtual machines within a single Proximity Placement Group restricted to a single Availability Zone.

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones in the region.; Use a Standard Load Balancer to distribute traffic to the virtual machines.

Answer

To meet the requirements, you should deploy the virtual machines across two or more Availability Zones in the region and use a Standard Load Balancer to distribute traffic to them.

Distributing the virtual machines across multiple Availability Zones is required to meet the 99.99% SLA and ensure resilience against zone outages. A Standard Load Balancer is necessary to route traffic to virtual machines across different zones because it supports zone-redundant backend pools.

Step-by-Step Solution

Analyze the high availability and SLA requirements.

The workload requires a 99.99% virtual machine uptime SLA and resilience against zone-level failures.

This establishes the baseline architectural redundancy required.

Determine the appropriate virtual machine placement strategy.

Select multi-zone deployment (deploying virtual machines across at least two Availability Zones).

Azure offers a 99.99% uptime SLA only when two or more VM instances are deployed across two or more Availability Zones in the same region.

Select a load balancing solution that supports the placement strategy.

Use a Standard Load Balancer.

Standard Load Balancer is a zone-redundant service that can route traffic across multiple Availability Zones, whereas Basic Load Balancer is not zone-redundant.

Key Concept

Designing high availability for Azure compute using Availability Zones and Standard Load Balancer.

Question 1117Question →

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-weur` ( $10.100.0.0/16$ ), hosts an Azure Firewall at $10.100.1.4$ and an ExpressRoute gateway. The spoke virtual network, `vnet-prod-weur` ( $10.101.0.0/16$ ), contains a subnet named `subnet-app` ( $10.101.1.0/24$ ). The on-premises network uses the IP address space $172.16.0.0/12$ .

The routing design must meet the following requirements:
1. All internet-bound traffic from `subnet-app` must be routed through the Azure Firewall in the hub.
2. All traffic from `subnet-app` destined for the on-premises network must be routed through the ExpressRoute gateway.
3. Local traffic within `vnet-prod-weur` must bypass the Azure Firewall.

Which two configurations should you recommend to meet these requirements? (Select TWO)

Select all that apply

Configure the virtual network peering connection to allow gateway transit on `vnet-hub-weur` and use the remote virtual network's gateway on `vnet-prod-weur`.

In the route table associated with `subnet-app`, add a route for `0.0.0.0/0` with the next hop type set to Virtual appliance and the next hop address set to

10.100.1.4

In the route table associated with `subnet-app`, add a route for `10.101.0.0/16` with the next hop type set to Virtual appliance and the next hop address set to

10.100.1.4

In the route table associated with `subnet-app`, add a route for `172.16.0.0/12` with the next hop type set to Virtual network gateway, without configuring gateway transit on the peering connection.

Show answer & explanation

Answer: Configure the virtual network peering connection to allow gateway transit on `vnet-hub-weur` and use the remote virtual network's gateway on `vnet-prod-weur`.; In the route table associated with `subnet-app`, add a route for `0.0.0.0/0` with the next hop type set to Virtual appliance and the next hop address set to $10.100.1.4$ .

Answer

Configure the virtual network peering connection to allow gateway transit on the hub VNet and use the remote gateway on the spoke VNet, and add a user-defined route for the default route pointing to the Azure Firewall IP in the subnet's route table.

To route internet-bound traffic through the firewall, a route for the default route is required in the route table associated with the subnet. Azure's Longest Prefix Match ensures that the local virtual network route takes precedence over the default route, keeping local traffic local and bypassing the firewall. To connect to the on-premises network via the hub's gateway, gateway transit must be configured on the peering relationship, which makes the gateway route inheritable by the spoke.

Step-by-Step Solution

Configure gateway transit on the virtual network peering.

Allows the spoke VNet to access the ExpressRoute gateway in the hub VNet.

By default, virtual network peering is non-transitive. Enabling gateway transit allows resources in the spoke VNet to route traffic through the hub's gateway to on-premises networks.

Define the default route in the user-defined route table.

Traffic destined for the internet is sent to the Azure Firewall private IP.

A user-defined route for the default route overrides the default system route for internet traffic, sending it to the firewall for inspection.

Rely on system routes and Longest Prefix Match (LPM) for local traffic.

Local traffic within the spoke VNet bypasses the firewall.

Since the local VNet prefix is more specific than the default route, the system route for local traffic remains active and ensures local communication does not route to the firewall.

Key Concept

Hub-and-spoke routing with gateway transit and default route redirection using User-Defined Routes.

Question 1118Question →

A company is designing the compute infrastructure on Azure for a legacy background processing application. The application has the following characteristics and requirements:
- It processes long-running batch jobs that take up to 45 minutes to complete.
- It must run continuously 24/7 and cannot tolerate unexpected interruptions or evictions.
- The solution must be highly available and resilient to datacenter outages within an Azure region.

Which compute solution should you recommend to meet these requirements?

Azure Virtual Machines deployed in a Virtual Machine Scale Set across multiple availability zones

Azure Spot Virtual Machines in a Virtual Machine Scale Set deployed across multiple availability zones

Azure Functions running on a Consumption plan

Azure Virtual Machines deployed in an availability set within a single availability zone

Show answer & explanation

Answer: Azure Virtual Machines deployed in a Virtual Machine Scale Set across multiple availability zones

Answer

Azure Virtual Machines deployed in a Virtual Machine Scale Set across multiple availability zones

The correct solution uses standard Azure Virtual Machines deployed across multiple availability zones. This provides persistent compute hosting that allows the 45-minute batch jobs to run without execution timeout restrictions, guarantees that the VMs will not be evicted, and ensures resilience against localized datacenter failures.

Step-by-Step Solution

Evaluate execution time requirements

Since the batch jobs require 45 minutes to complete, serverless compute options with short execution timeouts (such as Azure Functions on a Consumption plan, which limits execution to 10 minutes) must be ruled out in favor of full virtual machines that support unrestricted execution runtimes.

To ensure long-running processes can complete successfully without system-imposed timeouts.

Evaluate workload stability and eviction tolerance

Since the workload is a critical 24/7 production process that cannot tolerate unexpected interruptions or evictions, Spot VMs are ruled out because they are subject to sudden eviction based on capacity demands.

To satisfy the requirement that the application must run continuously without eviction.

Evaluate high availability and zone-resilience requirements

To protect against datacenter outages within an Azure region, the virtual machines must be distributed across multiple availability zones. Standard availability sets only protect against hardware or power failures within a single zone.

To meet the resilience requirement against localized datacenter outages.

Key Concept

Selecting appropriate Azure compute virtualization and deployment topologies based on availability, runtime, and stability constraints.

Estimated Time:1m 30s

Question 1119Question →

Lumina Financials is designing a secure architecture for a cloud database application deployed on virtual machines in a virtual network subnet named Subnet1. The virtual machines require outbound connectivity to Azure Storage and Azure SQL Database in the same region to perform nightly data transfers. You need to configure a Network Security Group (NSG) associated with Subnet1 to permit outbound traffic to only these services while blocking all other outbound internet traffic. The solution must minimize administrative overhead when IP address ranges for the Azure services change. Which NSG outbound rule configuration should you recommend?

Create outbound rules that use the Storage and Sql Service Tags as the destination.

Create outbound rules that use the individual IP address ranges of the regional Azure Storage and Azure SQL Database endpoints as the destination.

Create an Application Security Group (ASG) containing the Azure SQL and Storage endpoints, and use the ASG as the destination in the outbound rules.

Create User Defined Routes (UDRs) to route all outbound traffic through an Azure Firewall, and manually configure network rules with the individual IP addresses of the Azure services.

Show answer & explanation

Answer: Create outbound rules that use the Storage and Sql Service Tags as the destination.

Answer

Create outbound rules that use the Storage and Sql Service Tags as the destination.

The correct option is to use the built-in Storage and Sql Service Tags. Service Tags represent a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, which minimizes administrative overhead.

Step-by-Step Solution

Identify the destination services requiring access.

Azure Storage and Azure SQL Database are the target services.

The VMs need outbound access to these specific Azure PaaS services.

Select the appropriate network security mechanism that minimizes administrative overhead.

Service Tags represent groups of IP address prefixes from managed Azure services.

Using Service Tags eliminates the need to manually track and update IP address ranges.

Configure the NSG outbound security rules.

Two rules are created targeting the Storage and Sql Service Tags respectively.

This allows required traffic while a lower-priority rule blocks all other outbound internet traffic.

Key Concept

Azure Service Tags simplify NSG management by representing groups of IP address prefixes for specific Azure services.

Estimated Time:1m 30s

Question 1120Question →

A retail company is migrating its e-commerce inventory management portal to Azure. The portal has the following requirements:

* It must run on virtual machines to support legacy dependencies and custom operating system kernel configurations.
* It must automatically scale the number of virtual machine instances to meet fluctuating traffic demand.
* It must guarantee a Service Level Agreement (SLA) of $99.95\%$ for compute availability.
* It must support running a mix of virtual machine sizes (specifically, memory-optimized E-series and general-purpose D-series instances) within the same group to handle different workloads.
* It must distribute the virtual machines across multiple physical fault domains in the Azure region.

Which compute solution should you design to meet these requirements?

A Virtual Machine Scale Set configured in Flexible orchestration mode

A Virtual Machine Scale Set configured in Uniform orchestration mode using Azure Spot Virtual Machines

A Virtual Machine Scale Set configured in Uniform orchestration mode deployed within a single Availability Zone

Azure Functions running on a Consumption plan to host the application pages

Show answer & explanation

Answer: A Virtual Machine Scale Set configured in Flexible orchestration mode

Answer

A Virtual Machine Scale Set configured in Flexible orchestration mode

A Virtual Machine Scale Set in Flexible orchestration mode is the correct design. It allows the integration of heterogeneous virtual machine sizes (specifically memory-optimized E-series and general-purpose D-series) in the same scale set, supports custom images and operating system kernels, automatically scales based on demand, and provides a

99.95\%

availability SLA when virtual machines are distributed across physical fault domains in an Azure region.

Step-by-Step Solution

Analyze the workload requirements for legacy compatibility and OS access.

The requirement to run legacy dependencies and configure custom operating system kernels rules out serverless options such as Azure Functions.

Serverless platforms abstract away the host OS, preventing custom kernel configuration.

Evaluate the orchestration mode requirements for Virtual Machine Scale Sets.

Uniform orchestration mode requires identical VM sizes, whereas Flexible orchestration mode allows mixing different VM series (e.g., D-series and E-series) within the same scale set.

The requirement states that a mix of general-purpose and memory-optimized instances must run in the same group.

Verify high availability and fault domain requirements.

Flexible orchestration mode guarantees a

99.95\%

SLA when virtual machines are distributed across multiple fault domains in a region.

This configuration meets the SLA and physical fault isolation requirements without relying on Spot instances or single availability zones.

Key Concept

Azure Virtual Machine Scale Sets Flexible Orchestration

Estimated Time:2m 0s

PreviousPage 56 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept