Examkin

All practice questions

1198 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 1121Question →

A logistics enterprise is designing a regional application architecture in the East US region. The system includes two distinct components:
1. A fleet of backend Virtual Machines (VMs) that ingest raw TCP telemetry from package scanners on port 5001. The VMs are currently assigned Basic SKU Public IP addresses.
2. A web management application that requires SSL/TLS termination and URL path-based routing (e.g., routing '/api/*' and '/static/*' to different backend pools).

The enterprise requires a load balancing design that satisfies all protocol and routing requirements while ensuring compatibility with Azure SKU constraints.

Which load balancing architecture should you design for this application?

Show answer & explanation

Answer: Upgrade the Public IP addresses of the backend VMs to Standard SKU, deploy an Azure Standard Load Balancer to distribute the TCP telemetry traffic, and deploy an Azure Application Gateway (v2) to manage the web management application traffic.

Answer

Upgrade the Public IP addresses of the backend VMs to Standard SKU, deploy an Azure Standard Load Balancer to distribute the TCP telemetry traffic, and deploy an Azure Application Gateway (v2) to manage the web management application traffic.
The correct solution uses an Azure Standard Load Balancer for the Layer 4 TCP telemetry traffic and an Azure Application Gateway for the Layer 7 HTTPS web management traffic. To prevent validation errors, the Basic SKU Public IPs on the backend VMs must be upgraded to Standard SKU because Standard Load Balancers do not support backend VMs with Basic SKU IP configurations.

Step-by-Step Solution

1
Identify the protocol requirements for both layers of the application.
The telemetry ingestion layer requires Layer 4 TCP load balancing on port 5001. The web management application requires Layer 7 features including SSL/TLS termination and path-based routing.
This establishes which load balancer types (Layer 4 vs Layer 7) are appropriate for each workload.
2
Select the appropriate Azure services for the load balancing requirements.
Azure Standard Load Balancer is selected for the Layer 4 TCP ingestion traffic, and Azure Application Gateway is selected for the regional Layer 7 HTTPS management traffic.
Standard Load Balancer handles high-throughput Layer 4 traffic, while Application Gateway provides the path routing and TLS termination required for the web application.
3
Analyze Azure SKU compatibility rules for the backend pool.
Backend VMs with Basic SKU Public IPs cannot be placed in the backend pool of a Standard Load Balancer.
Azure enforces that all network resources associated with a Standard Load Balancer backend pool must use Standard SKU IP addresses to prevent configuration mismatches.
4
Determine the necessary remediation to satisfy the SKU constraints.
The Public IPs of the backend VMs must be upgraded to Standard SKU to allow successful association with the Standard Load Balancer.
Upgrading the IPs resolves the SKU mismatch validation error.

Key Concept

Azure load balancing selection based on protocol support and SKU compatibility rules.
Question 1122Question →

A manufacturing corporation is planning the Azure compute architecture for two internal workloads:

- Workload 1: An automated data analysis engine that processes non-critical, interruptible batch jobs. The jobs can be safely restarted if interrupted, and minimizing compute cost is the primary objective.
- Workload 2: A core ERP database application that runs constantly and has strict regulatory requirements specifying that the virtual machines must run on dedicated physical hardware.

Which two compute virtualization solutions should you include in the design?

Select all that apply

Show answer & explanation

Answer: Azure Spot Virtual Machines to run the data analysis engine.; Azure Dedicated Hosts to run the ERP database application virtual machines.

Answer

The correct compute virtualization solutions are using Azure Spot Virtual Machines to run the data analysis engine and Azure Dedicated Hosts to run the ERP database application virtual machines.
The correct strategy combines Azure Spot VMs and Azure Dedicated Hosts. Spot VMs are designed for workloads that can be interrupted, offering the lowest possible cost for the data analysis engine. Dedicated Hosts provide physical hardware isolation, satisfying the regulatory compliance requirement for the ERP database.

Step-by-Step Solution

1
Analyze the requirements for Workload 1
Workload 1 requires low cost and can tolerate interruptions and restarts.
Identify which Azure VM tier matches interruptible, cost-sensitive batch processing.
2
Select the appropriate option for Workload 1
Azure Spot Virtual Machines are selected for Workload 1.
Spot VMs offer steep discounts (up to 90%) in exchange for the possibility of eviction, which fits the non-critical nature of the workload.
3
Analyze the requirements for Workload 2
Workload 2 requires dedicated physical hardware to meet isolation compliance mandates.
Identify which Azure virtualized compute option provides dedicated physical host-level isolation.
4
Select the appropriate option for Workload 2
Azure Dedicated Hosts are selected for Workload 2.
Azure Dedicated Hosts allocate physical servers to a single subscription, ensuring compliance and physical isolation.

Key Concept

Selecting Azure compute tiers based on cost-efficiency (Spot VMs) versus regulatory and isolation constraints (Dedicated Hosts).
Question 1123Question →

NovaBio Research is designing a secure network architecture in Azure to support a team of remote laboratory researchers. The researchers must connect to Azure Virtual Machines deployed in a private subnet.

The architecture must meet the following requirements:
* Remote researchers must be able to establish secure, encrypted, client-based connections to the virtual machines over the public internet without exposing the virtual machines directly to the internet.
* The virtual machines must be prevented from initiating outbound connections to the internet, except for necessary data uploads to Azure Storage.

Which two actions should you perform to meet the requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Network Security Group (NSG) associated with the VM subnet with an outbound rule that denies outbound traffic to the Internet, and a higher-priority outbound rule that allows outbound traffic to the Storage service tag.; Deploy an Azure VPN Gateway in the virtual network and configure Point-to-Site (P2S) VPN connections for the remote researchers.

Answer

To meet the security requirements, you should deploy an Azure VPN Gateway in the virtual network and configure Point-to-Site (P2S) VPN connections for remote client access, and configure an NSG on the VM subnet with an outbound deny rule for the Internet and a higher-priority outbound allow rule for the Storage service tag.
Deploying an Azure VPN Gateway configured for Point-to-Site (P2S) VPN provides secure, client-based connection over the internet directly to the private subnet without public endpoints on the virtual machines. Additionally, configuring an NSG with an outbound rule denying internet access alongside a higher-priority rule allowing traffic to the Storage service tag ensures VMs can only upload data to Azure Storage and cannot access the rest of the public internet.

Step-by-Step Solution

1
Address remote secure client access.
Identify Point-to-Site (P2S) VPN as the secure client-based connection method over the public internet to the virtual network.
This satisfies the requirement to allow remote researchers to connect securely without public IP exposure on the virtual machines.
2
Configure outbound access controls.
Use Network Security Groups (NSGs) with built-in service tags to block general outbound internet access while permitting traffic specifically to Azure Storage.
This meets the security requirement with minimal administrative effort by avoiding manually tracking and updating target IP addresses.

Key Concept

Designing secure network connectivity and access control using VPN Gateway and Network Security Groups with Service Tags.
Question 1124Question →

A logistics company is designing an event-driven processing workflow for shipping manifests uploaded to Azure Blob Storage. Each manifest triggers a processing task that parses the file, cross-references international customs databases, and generates a compliance report. The task takes approximately 12 minutes to complete and runs sporadically throughout the day. You need to recommend a serverless compute option that supports this execution duration while minimizing costs by scaling to zero instances when no manifests are being processed. Which solution should you recommend?

Show answer & explanation

Answer: An Azure Container Apps job

Answer

An Azure Container Apps job
The correct answer is the option specifying an Azure Container Apps job. This service is designed for run-to-completion, event-driven tasks that can execute for hours. It scales down to zero instances when idle, ensuring that costs are minimized, while avoiding the operational overhead associated with managing a full Kubernetes cluster.

Step-by-Step Solution

1
Evaluate the execution duration against the limits of Consumption-based serverless options.
The task requires 12 minutes of processing, which exceeds the 10-minute maximum execution timeout limit of Azure Functions on a Consumption plan.
This rules out standard Consumption-based Azure Functions as they would terminate the execution before completion.
2
Evaluate the scaling and operational overhead requirements.
The solution must scale to zero when idle to minimize costs, and it should minimize administrative overhead.
This rules out dedicated App Service plans or virtual machine-based solutions that incur continuous idle costs, and rules out complex orchestrators like Azure Kubernetes Service (AKS) which add administrative complexity.
3
Select the serverless compute resource designed for run-to-completion containerized tasks.
Azure Container Apps jobs are identified as the best fit because they support event-driven triggers, run-to-completion execution for hours, and scale to zero when idle.
This provides a low-overhead, serverless environment matching all constraints.

Key Concept

Selecting serverless compute services based on execution duration limits, operational overhead, and scale-to-zero requirements.
Estimated Time:1m 30s
Question 1125Question →

A financial organization is deploying a hybrid network architecture. A central virtual network named `vnet-transit-hub` (172.20.0.0/16172.20.0.0/16) connects to the company's on-premises datacenter through an Azure ExpressRoute gateway. To support dynamic routing, the organization deploys a third-party Network Virtual Appliance (NVA) in `vnet-transit-hub` within a subnet named `snet-nva` (172.20.1.0/24172.20.1.0/24). An Azure Route Server is deployed in the mandatory `RouteServerSubnet` (172.20.2.0/24172.20.2.0/24) to exchange routing information.

The organization needs to ensure that the NVA and the on-premises datacenter can dynamically exchange routing information through BGP without maintaining manual static routes.

Which design action must be taken to support this routing requirement?

Show answer & explanation

Answer: Configure BGP peering between the Network Virtual Appliance (NVA) and the Azure Route Server, and enable the branch-to-branch setting on the Azure Route Server.

Answer

Configure BGP peering between the Network Virtual Appliance (NVA) and the Azure Route Server, and enable the branch-to-branch setting on the Azure Route Server.
To exchange routes dynamically, BGP peering must be configured between the Route Server and the NVA. In addition, the branch-to-branch (Route-to-Route) setting on the Azure Route Server must be enabled to allow it to propagate routes between the ExpressRoute gateway and the NVA.

Step-by-Step Solution

1
Establish BGP peering between the NVA and Azure Route Server.
The Route Server learns the routes advertised by the NVA, and the NVA learns the routes known to the Route Server.
BGP peering is required for Azure Route Server to dynamically build its routing table using the NVA as a peer.
2
Enable the branch-to-branch (Route-to-Route) setting on Azure Route Server.
Dynamic route exchange is permitted between the ExpressRoute gateway and the NVA.
By default, Azure Route Server does not propagate routes directly between virtual network gateways (like ExpressRoute or VPN) and peered NVAs. Enabling branch-to-branch permits transitivity.

Key Concept

Azure Route Server enables dynamic route propagation between NVAs and virtual network gateways. Peering the NVA with the Route Server and enabling branch-to-branch connectivity are required to allow transit routing.

Alternative Method

Instead of using Azure Route Server, you could configure static routes (UDRs) in every spoke VNet pointing to the NVA's IP address. However, this is not dynamic and does not scale well as the network grows, making Route Server the optimal design choice.
Estimated Time:1m 30s
Question 1126Question →

A manufacturing company is planning to migrate its on-premises supply chain management (SCM) system from a physical server environment to Azure. The SCM system consists of three physical servers: a database server running SQL Server 2016, an application server running a background Windows service, and a reporting server.

The SCM system has the following requirements and technical constraints:
* The database utilizes SQL Server Agent jobs for nightly inventory reconciliation, cross-database queries, and Service Broker.
* The application server requires sub-millisecond network latency to the database server.
* On-premises users must access the migrated application using single sign-on (SSO).
* The identity solution must minimize operational complexity and administrative overhead. The company's security policy permits storing password hashes in the cloud.

You need to design the migration assessment and target architecture.

Which recommendation meets the requirements?

Show answer & explanation

Answer: Assess dependencies by installing the Azure Migrate dependency agent on the physical servers. Migrate the SQL Server database to Azure SQL Managed Instance. Implement hybrid identity by configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO.

Answer

Assess dependencies by installing the Azure Migrate dependency agent on the physical servers. Migrate the SQL Server database to Azure SQL Managed Instance. Implement hybrid identity by configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO.
The correct recommendation is to install the Azure Migrate dependency agent on the physical servers, migrate the database to Azure SQL Managed Instance, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO. Agent-based dependency mapping is required for physical servers to analyze network connections and ensure sub-millisecond latency dependencies are met. Azure SQL Managed Instance is the appropriate database target since it supports SQL Server Agent, cross-database queries, and Service Broker. PHS with Seamless SSO provides SSO functionality with the lowest operational complexity.

Step-by-Step Solution

1
Determine database migration target based on feature requirements.
Select Azure SQL Managed Instance.
The on-premises database utilizes SQL Server Agent, cross-database queries, and Service Broker, which are not supported in Azure SQL Database but are fully supported in Azure SQL Managed Instance.
2
Select the correct dependency assessment tool and method for physical servers.
Use Azure Migrate with agent-based dependency mapping.
Agent-based mapping is required for physical servers to discover network dependencies and ensure components requiring sub-millisecond latency are grouped appropriately. Agentless dependency analysis is not supported for physical servers.
3
Select hybrid identity synchronization method to meet SSO and complexity requirements.
Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO.
This configuration provides a single sign-on experience for on-premises users while keeping administrative and infrastructure overhead to a minimum, as permitted by the security policy.

Key Concept

Designing migration strategies, database target selection, and identity synchronization for physical workloads.
Question 1127Question →

Helios Energy Services is designing a secure network infrastructure in Azure. A virtual network contains a subnet named Subnet1, which hosts virtual machines (VMs) that run an application. The VMs require access to secrets stored in Azure Key Vault. According to company policy, all outbound internet traffic from Subnet1 must be blocked, except for traffic destined for Azure Key Vault. You need to recommend a network security solution that satisfies the company policy while minimizing administrative overhead. What should you recommend?

Show answer & explanation

Answer: Associate a Network Security Group (NSG) with Subnet1. Create an outbound security rule that allows traffic to the AzureKeyVault service tag, and a lower-priority outbound security rule that denies traffic to the Internet service tag.

Answer

Associate a Network Security Group (NSG) with Subnet1, create an outbound security rule allowing traffic to the AzureKeyVault service tag, and create a lower-priority rule denying traffic to the Internet service tag.
The correct option is to associate a Network Security Group (NSG) with Subnet1, create a rule allowing outbound traffic to the AzureKeyVault service tag, and create a lower-priority rule denying outbound traffic to the Internet service tag. This configuration allows the virtual machines to reach Azure Key Vault securely while blocking all other outbound internet traffic. Using service tags eliminates the need to manage individual IP ranges, minimizing administrative effort.

Step-by-Step Solution

1
Determine the optimal Azure resource for filtering traffic at the subnet level.
Identify that a Network Security Group (NSG) associated with Subnet1 is the standard and most efficient way to filter inbound and outbound network traffic.
NSGs operate at the subnet or network interface level to enforce security rules.
2
Select a method to define the destination for Azure Key Vault traffic that minimizes management effort.
Choose the built-in 'AzureKeyVault' service tag instead of maintaining individual public IP addresses.
Service tags represent a group of IP address prefixes from a given Azure service and are managed automatically by Microsoft, reducing administrative overhead.
3
Configure the rules and priorities to restrict internet access while permitting Key Vault traffic.
Create a higher-priority rule (e.g., priority 100) allowing outbound traffic to the 'AzureKeyVault' service tag, and a lower-priority rule (e.g., priority 200) denying outbound traffic to the 'Internet' service tag.
Rules are processed in priority order, so Key Vault traffic is allowed first before the general internet traffic block is applied.

Key Concept

Azure Network Security Group (NSG) Service Tags allow you to define network access controls for Azure services without manually managing IP addresses, minimizing administrative overhead while securing outbound connections.
Question 1128Question →

An educational technology company is designing a serverless video processing workflow for their on-demand learning platform. The workflow requires two components:

1. A background worker that extracts audio from uploaded videos and generates text transcripts. This process is CPU-heavy and takes between 15 to 30 minutes to complete per video.
2. A lightweight REST API that serves the transcripts to users. This API experiences highly sporadic traffic and must minimize cost by scaling to zero instances when idle.

Which two Azure hosting options should you recommend to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps Jobs to host the background video processing worker; Azure Functions on a Consumption plan to host the REST API

Answer

Azure Container Apps Jobs to host the background video processing worker, and Azure Functions on a Consumption plan to host the REST API.
Azure Container Apps Jobs are ideal for running background tasks that run to completion and can execute for longer durations without the 10-minute timeout limit of standard serverless functions. Azure Functions on a Consumption plan is the most cost-effective choice for a lightweight REST API with sporadic traffic because it scales down to zero instances when not in use, avoiding compute costs during idle periods.

Step-by-Step Solution

1
Analyze the requirements for the background worker.
The background worker requires CPU-heavy processing that runs for 15 to 30 minutes per video.
This exceeds the maximum execution timeout of 10 minutes for standard serverless functions hosted on Azure Functions Consumption plans, meaning we need a hosting model that supports long-running execution and containerization, such as Azure Container Apps Jobs.
2
Analyze the requirements for the REST API.
The REST API has highly sporadic traffic and must minimize cost by scaling down to zero instances when idle.
Azure Functions on a Consumption plan is the ideal serverless offering to host a lightweight API with sporadic load, as it scales down to zero dynamically to ensure you only pay when code is executing.
3
Verify service match and eliminate sub-optimal options.
Azure Container Apps Jobs handles the long-running worker, and Azure Functions on Consumption plan hosts the API.
Using Azure Functions Consumption plan for the worker fails due to timeout limits, while using an AKS cluster for the API introduces unnecessary management overhead and continuous compute costs.

Key Concept

Designing serverless host options based on execution duration, scaling behavior, and management overhead constraints.
Estimated Time:2m 0s
Question 1129Question →

Skyward Aviation is designing a secure network architecture in Azure. You have a virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 hosts several virtual machines that run a legacy application. The virtual machines must access an Azure SQL database and an Azure Storage account. You need to design a network security and private access solution that meets the following requirements:
- Access to the Azure SQL database and Azure Storage account must be restricted to only traffic originating from Subnet1.
- The public IP addresses of the Azure SQL database and Azure Storage account must not be exposed to the virtual machines.
- The virtual machines must connect to the services using private IP addresses.
- Administrative effort to maintain the network configuration must be minimized.

Which two actions should you recommend?

Select all that apply

Show answer & explanation

Answer: Deploy a Private Endpoint for the Azure SQL database and a Private Endpoint for the Azure Storage account in VNet1.; Configure private DNS zones in Azure for the services and link the zones to VNet1.

Answer

To meet the requirements, you should deploy a Private Endpoint for the Azure SQL database and a Private Endpoint for the Azure Storage account in the virtual network, and configure private DNS zones in Azure for the services and link the zones to the virtual network.
Deploying Private Endpoints allocates private IP addresses from the virtual network to the Azure SQL database and Azure Storage account, ensuring all communication remains within the Microsoft backbone network and is not exposed to the public internet. Configuring Private DNS zones and linking them to the virtual network enables the application to automatically resolve the services' FQDNs to their private IPs without manual hosts file updates or custom DNS server management, which minimizes administrative overhead.

Step-by-Step Solution

1
Select the appropriate private access technology.
Private Endpoints are selected because they assign private IP addresses from the virtual network to the services, preventing public IP exposure.
The requirement specifies that virtual machines must connect to the services using private IP addresses and public IP addresses must not be exposed.
2
Ensure proper name resolution for the private endpoints.
Private DNS zones are created for the database and storage services, and linked to the virtual network.
This allows the application to continue using the services' fully qualified domain names (FQDNs) while resolving them to the private IP addresses of the Private Endpoints, keeping administrative effort low.

Key Concept

Private access to Azure services using Private Endpoints and Private DNS Zones to avoid public endpoint exposure.
Question 1130Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure:
- The hub virtual network, `vnet-hub-weur`, has the address space 10.10.0.0/1610.10.0.0/16 and hosts an Azure Firewall at 10.10.1.410.10.1.4.
- The spoke virtual network, `vnet-spoke-prod`, has the address space 10.20.0.0/1610.20.0.0/16 and contains a subnet named `snet-app` (10.20.1.0/2410.20.1.0/24).
- Virtual network peering is established between `vnet-hub-weur` and `vnet-spoke-prod` with transit enabled.

The enterprise has the following routing requirements for traffic originating from `snet-app`:
1. All traffic destined for the internet must be inspected by the Azure Firewall in `vnet-hub-weur`.
2. All traffic destined for resources in `vnet-hub-weur` must be inspected by the Azure Firewall.
3. Traffic destined for other subnets within `vnet-spoke-prod` must bypass the firewall and route directly.

You need to configure the route table associated with `snet-app` to meet these requirements. Which two route configurations should you add? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A route for 0.0.0.0/00.0.0.0/0 with a next hop type of `Virtual appliance` and a next hop IP address of 10.10.1.410.10.1.4.; A route for 10.10.0.0/1610.10.0.0/16 with a next hop type of `Virtual appliance` and a next hop IP address of 10.10.1.410.10.1.4.

Answer

The correct configurations are to add a route for 0.0.0.0/00.0.0.0/0 with a next hop of the firewall IP (10.10.1.410.10.1.4) and a route for the hub address space (10.10.0.0/1610.10.0.0/16) pointing to the same firewall IP.
To route internet traffic to the firewall, you must define a default route of 0.0.0.0/00.0.0.0/0 pointing to the firewall's private IP address as a virtual appliance. To route traffic destined for the hub virtual network through the firewall instead of the direct peering connection, you must explicitly define a route for the hub IP address range (10.10.0.0/1610.10.0.0/16) pointing to the firewall. This is because user-defined routes (UDRs) have higher precedence than system-defined peering routes.

Step-by-Step Solution

1
Determine the route required to inspect internet-bound traffic.
Create a route for 0.0.0.0/00.0.0.0/0 with next hop type set to `Virtual appliance` and the next hop IP address set to the firewall IP (10.10.1.410.10.1.4).
This redirects all default traffic (internet) to the firewall instead of using the default system route for the internet.
2
Determine how to inspect traffic going to the hub virtual network.
Create a route for 10.10.0.0/1610.10.0.0/16 with next hop type set to `Virtual appliance` and the next hop IP address set to the firewall IP (10.10.1.410.10.1.4).
By default, virtual network peering creates a system route for the peered range (10.10.0.0/1610.10.0.0/16) with next hop type `VNet peering`. To inspect this traffic, a user-defined route must be created for the same prefix, which takes precedence over the system route.
3
Evaluate the need for routing within the local spoke virtual network.
Leave local routing to the default system route for the virtual network (10.20.0.0/1610.20.0.0/16).
Azure automatically routes traffic within the same virtual network locally. Creating a user-defined route for the local virtual network range pointing to the firewall would incorrectly intercept intra-spoke traffic, breaking the requirement to bypass the firewall for local communication.

Key Concept

Azure User-Defined Routes (UDR) precedence and path selection in hub-and-spoke topologies.
Question 1131Question →

An organization is planning to migrate a legacy enterprise resource planning (ERP) system hosted on-premises on physical servers to Azure. The system consists of two application servers running a proprietary Java application that communicates with several unidentified legacy internal services, and a SQL Server database that utilizes SQL Server Agent jobs, cross-database queries, and SQL Common Language Runtime (CLR) integration. The organization requires that users authenticate using their existing on-premises credentials while avoiding the deployment and management of federation infrastructure. Which two actions should you include in the migration assessment and strategy? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Recommend migrating the database to Azure SQL Managed Instance.; Recommend configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO).

Answer

Migrate the database to Azure SQL Managed Instance, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO).
The correct strategy involves migrating the database to Azure SQL Managed Instance because it supports legacy SQL Server features like cross-database queries, SQL Server Agent, and SQL CLR. For identity, configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO provides on-premises credentials for users without the complexity of deploying federation services (AD FS).

Step-by-Step Solution

1
Analyze database requirements.
The database uses SQL Server Agent, cross-database queries, and SQL CLR.
To select a compatible cloud database hosting option.
2
Determine the database tier.
Azure SQL Managed Instance supports these legacy database features, whereas Azure SQL Database does not.
To ensure functional parity and avoid rewriting application code.
3
Analyze identity requirements.
The organization needs on-premises authentication but wants to avoid federation infrastructure.
To choose a hybrid identity solution that minimizes operational complexity.
4
Determine the identity synchronization method.
Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO satisfies this requirement without AD FS.
To meet authentication requirements with low administrative overhead.
5
Analyze application dependencies.
The application has dependencies on unidentified legacy services, requiring dependency mapping before migration.
To ensure all dependent components are identified and migrated together, preventing post-migration connectivity issues.

Key Concept

Analyzing database requirements, identity synchronization, and application dependencies for Azure migration assessment.
Question 1132Question →

An insurance firm is designing the compute infrastructure for a new core claims processing application. The application has the following requirements:
- It runs a steady-state, critical production workload that operates 24/7.
- It requires high memory-to-CPU ratios for memory-intensive data analysis.
- It must meet an SLA of 99.99% uptime.
- It must minimize costs for baseline continuous usage.

Which two compute configurations should you recommend to meet these requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy E-series virtual machines within a Virtual Machine Scale Set in Flexible orchestration mode spread across multiple Availability Zones.; Utilize Azure Reserved Virtual Machine Instances for the selected virtual machine sizes.

Answer

Deploy E-series virtual machines within a Virtual Machine Scale Set in Flexible orchestration mode spread across multiple Availability Zones, and utilize Azure Reserved Virtual Machine Instances for the selected virtual machine sizes.
To meet the 99.99% uptime SLA and high memory requirements of the claims processing application, you should deploy E-series (memory-optimized) virtual machines across multiple Availability Zones using a Virtual Machine Scale Set in Flexible orchestration mode. Additionally, because the workload is steady-state and operates 24/7, Azure Reserved Virtual Machine Instances should be utilized to minimize baseline compute costs.

Step-by-Step Solution

1
Analyze the workload characteristics and SLA requirements.
The workload requires high memory-to-CPU ratios (demanding E-series virtual machines) and must meet a 99.99% availability SLA (demanding deployment across multiple Availability Zones, such as using Virtual Machine Scale Sets in Flexible orchestration mode).
Correct virtual machine series selection and high availability design are critical to meeting technical and business requirements.
2
Determine the appropriate billing model for a 24/7 steady-state workload.
Azure Reserved Virtual Machine Instances should be used for cost optimization instead of Spot Virtual Machines.
Steady-state workloads running continuously benefit from the cost reduction of reservation commitments, whereas Spot Virtual Machines can be evicted and do not guarantee uptime.

Key Concept

Designing highly available, cost-effective compute solutions using appropriate VM series, orchestration modes, and purchasing options.
Question 1133Question →

A renewable energy provider is designing a solution to process daily wind turbine telemetry logs. The logs are collected and uploaded as a ZIP archive to Azure Blob Storage once per day. A containerized console application must extract the archive, validate the data format, and write the output to a database. The processing task runs sequentially and takes approximately 15 minutes to complete. The provider wants to minimize ongoing costs, ensure the task runs to completion, and minimize operational management overhead.

Which Azure service should you recommend to host the processing application?

Show answer & explanation

Answer: Azure Container Apps Jobs

Answer

Azure Container Apps Jobs
Azure Container Apps Jobs are the optimal choice because they are designed for run-to-completion containerized tasks. They run on-demand, scale down to zero when idle to minimize costs, support execution times longer than 10 minutes, and do not require the overhead of managing a Kubernetes cluster.

Step-by-Step Solution

1
Analyze the execution duration requirement of the workload.
The workload runs for approximately 15 minutes, which rules out hosting options with strict timeout limitations under 15 minutes.
Identify hosting options that can support tasks running longer than the typical serverless default of 5 to 10 minutes.
2
Evaluate the management and operational overhead constraints.
The requirement to minimize operational overhead rules out full container orchestrator platforms or virtual machine management.
Determine if the service requires manual provisioning, patching, or scaling configuration of underlying nodes.
3
Evaluate cost and scaling behavior during idle periods.
The workload runs once per day, so a serverless model that scales down to zero when inactive is required to minimize cost.
Match the daily on-demand execution pattern with a billing model that only charges for active execution time.

Key Concept

Selecting the appropriate Azure serverless or container hosting service based on execution duration, operational overhead, and scaling requirements.

Alternative Method

Alternatively, you could run the workload using Azure Container Instances (ACI) triggered by a logic app, though Azure Container Apps Jobs provides native scaling and event-driven triggers optimized for batch jobs.
Estimated Time:1m 30s
Question 1134Question →

A municipal transit authority is designing the regional application delivery and load balancing architecture for its new passenger information system in the North Europe region. The system consists of two primary workloads deployed within a single virtual network:

1. A passenger-facing web portal that requires SSL/TLS termination, cookie-based session affinity, and URL path-based routing (routing `/schedules/*` and `/fares/*` to separate backend pools).
2. A real-time vehicle telemetry ingestion service that processes continuous location data sent over UDP port 5099.

The backend VMs for the telemetry service currently have Basic SKU public IP addresses assigned to their network interfaces.

You need to recommend a load balancing solution that meets all technical requirements while ensuring architectural compatibility.

Which load balancing solution should you recommend?

Show answer & explanation

Answer: Deploy Azure Application Gateway Standard v2 to load balance the web portal, and deploy Azure Standard Load Balancer to load balance the telemetry service after upgrading the telemetry VMs' public IP addresses to Standard SKU.

Answer

Deploy Azure Application Gateway Standard v2 to load balance the web portal, and deploy Azure Standard Load Balancer to load balance the telemetry service after upgrading the telemetry VMs' public IP addresses to Standard SKU.
The correct solution uses Azure Application Gateway Standard v2 for the web portal because it natively supports Layer 7 capabilities including SSL/TLS termination, cookie-based affinity, and URL path-based routing. It uses Azure Standard Load Balancer for the telemetry service because the service uses the UDP protocol, which is not supported by Application Gateway. Upgrading the telemetry VMs' public IP addresses to Standard SKU is necessary because Azure does not permit VMs with Basic SKU public IP addresses to be members of a Standard Load Balancer's backend pool.

Step-by-Step Solution

1
Identify the routing requirements of the web portal.
These are Layer 7 application-layer routing capabilities, which require Azure Application Gateway (or Azure Front Door, but Front Door is global whereas this is regional).
Azure Load Balancer operates at Layer 4 and cannot inspect HTTP paths or handle cookie-based affinity.
2
Identify the routing requirements of the telemetry service.
This requires a Layer 4 load balancer since Azure Application Gateway only supports HTTP, HTTPS, HTTP/2, and WebSocket protocols.
Azure Standard Load Balancer is needed to route UDP traffic.
3
Evaluate backend compatibility and SKU constraints.
To attach these VMs to the Standard Load Balancer backend pool, their public IP addresses must be upgraded to Standard SKU.
You cannot mix Basic SKU public IP addresses with Standard SKU load balancers.

Key Concept

Combining Azure Application Gateway for Layer 7 web traffic and Azure Standard Load Balancer for Layer 4 UDP traffic, while resolving SKU mismatch limitations between Basic SKU public IPs and Standard SKU load balancers.
Question 1135Question →

A healthcare organization is designing a compute virtualization solution on Azure to host a new medical records processing application. The application must meet the following requirements:
- Process sensitive patient information and protect data in use using hardware-based memory encryption.
- Run continuously as a steady-state production service.
- Maximize availability by protecting against localized datacenter outages.

Which compute virtualization solution should you recommend?

Show answer & explanation

Answer: Confidential virtual machines deployed across multiple Azure availability zones

Answer

Confidential virtual machines deployed across multiple Azure availability zones
The correct option satisfies the requirement to protect data in use by using Confidential virtual machines, which support memory encryption. It also satisfies the availability requirement by deploying the VMs across multiple availability zones, ensuring resilience against localized datacenter failures.

Step-by-Step Solution

1
Identify the core security requirement to protect data in use.
Determine that Azure Confidential VMs utilizing hardware-based technologies (such as AMD SEV-SNP or Intel TDX) are required to encrypt memory and protect data during processing.
Standard VM series only support encryption at rest, whereas confidential computing is required for encrypting data in memory while it is actively being processed.
2
Evaluate the workload continuity and availability parameters.
Confirm that the steady-state, 24/7 nature of the workload rules out Spot VMs, and the need for protection against datacenter outages requires distributing VMs across multiple availability zones.
Spot VMs are designed for interruptible workloads and are subject to immediate eviction. Single-zone VM deployments do not protect against localized zone failures.
3
Select the design that satisfies all security, availability, and complexity constraints.
Recommend deploying Confidential virtual machines distributed across multiple availability zones.
This configuration secures data in use, ensures regional high availability, and avoids the unnecessary administrative overhead of deploying container orchestration platforms.

Key Concept

Azure Confidential Computing and Virtual Machine High Availability
Estimated Time:1m 30s
Question 1136Question →

A financial services provider is designing the Azure compute and storage infrastructure for two distinct workloads:

WorkloadCore RequirementsUptime SLAOperational ModeStorage Needs
Workload 1Physical hardware isolation99.99%99.99\%Continuous / Steady-stateLow-latency, high-throughput database transaction logs
Workload 2Budget-constrainedNonePeriodic / InterruptibleStandard storage

Which infrastructure strategy should you recommend to meet these requirements?

Show answer & explanation

Answer: Host Workload 1 on Azure Dedicated Hosts deployed across multiple Availability Zones using Premium SSD disks, and run Workload 2 on Azure Spot Virtual Machines.

Answer

Host Workload 1 on Azure Dedicated Hosts deployed across multiple Availability Zones using Premium SSD disks, and run Workload 2 on Azure Spot Virtual Machines.
The correct strategy hosts the transaction database (Workload 1) on Azure Dedicated Hosts to satisfy the regulatory hardware isolation requirement. These hosts are distributed across multiple Availability Zones to achieve the 99.99%99.99\% VM uptime SLA. The database transaction logs are placed on Premium SSDs to provide the necessary low-latency and high-throughput write performance. Finally, the non-critical, interruptible batch risk-modeling simulation (Workload 2) runs on Azure Spot VMs to maximize cost savings within strict budget limits.

Step-by-Step Solution

1
Address physical isolation and continuity requirements for Workload 1.
Azure Dedicated Hosts are selected because they provide physical servers dedicated to a single Azure subscription, satisfying compliance while running steady-state operations.
Regulatory compliance demands physical hardware isolation, which is uniquely solved by Dedicated Hosts rather than standard multi-tenant Azure VMs.
2
Select the availability and zone redundancy strategy for Workload 1.
Deploy the Dedicated Hosts across multiple Availability Zones.
An uptime SLA of 99.99%99.99\% for virtual machines in Azure requires instances to be spread across two or more Availability Zones in the same region.
3
Choose the appropriate storage tier for database transaction logs.
Select Premium SSD storage.
Database transaction logs are highly sensitive to write latency. Standard HDDs do not meet the performance thresholds required, necessitating Premium SSDs or Ultra Disks.
4
Select the cost-effective compute solution for Workload 2.
Use Azure Spot Virtual Machines.
Workload 2 is periodic, budget-constrained, and interruptible, making it an ideal candidate for Spot VMs which offer deep discounts in exchange for being evictable.

Key Concept

Designing virtualized compute solutions in Azure with specific constraints around physical isolation, high availability, disk latency, and cost optimization.
Question 1137Question →

An organization plans to migrate a customer billing application from an on-premises Nutanix AHV environment to Azure. The application consists of several Linux web servers and a SQL Server database tier. The database tier utilizes SQL Server Agent for scheduled data aggregation and requires cross-database queries across multiple databases. To prepare for the migration, the security team mandates that no software agents can be installed on the source servers for dependency mapping or discovery. The target database solution must be a Platform as a Service (PaaS) offering to reduce administrative overhead. User authentication must be integrated with Microsoft Entra ID using the simplest deployment model that supports credential synchronization, without deploying any federated or on-premises authentication agent servers. Which combination of discovery configuration, target database service, and hybrid identity synchronization should you recommend?

Show answer & explanation

Answer: Assessment: Deploy the Azure Migrate appliance and configure agentless dependency analysis. Database: Azure SQL Managed Instance. Identity: Microsoft Entra Connect with Password Hash Synchronization (PHS).

Answer

The correct recommendation is to use agentless dependency analysis with the Azure Migrate appliance, migrate the database to Azure SQL Managed Instance, and implement hybrid identity using Microsoft Entra Connect with Password Hash Synchronization (PHS).
The correct option addresses all technical and organizational constraints. First, agentless dependency analysis with the Azure Migrate appliance maps application dependencies without installing software on the source virtual machines, meeting the security constraint. Second, Azure SQL Managed Instance provides near-100% compatibility with the on-premises SQL Server database engine, supporting legacy features like SQL Server Agent and cross-database queries within a Platform as a Service (PaaS) model. Third, Microsoft Entra Connect with Password Hash Synchronization (PHS) is the simplest hybrid identity configuration because it synchronizes password hashes to Microsoft Entra ID, allowing authentication requests to be handled entirely in the cloud without requiring on-premises authentication agents or federated authentication infrastructure.

Step-by-Step Solution

1
Evaluate the assessment requirement for dependency mapping.
Determine that agentless dependency mapping using the Azure Migrate appliance must be configured.
The security team prohibits the installation of software agents on the source virtual machines, which rules out agent-based dependency mapping.
2
Evaluate the database tier requirements.
Select Azure SQL Managed Instance as the target database solution.
The application requires SQL Server Agent and cross-database queries. Azure SQL Database does not support these features natively. SQL Server on Azure Virtual Machines supports them but is an IaaS offering, violating the PaaS requirement.
3
Evaluate the hybrid identity synchronization requirements.
Select Microsoft Entra Connect with Password Hash Synchronization (PHS).
PHS is the simplest synchronization method and does not require on-premises authentication agent servers (unlike PTA) or federated authentication servers (unlike AD FS) to process or validate logins.

Key Concept

Selecting target migration services and assessment techniques based on technical compatibility, agent requirements, and operational complexity constraints.
Question 1138Question →

Astraeus Telemetry is designing a secure Azure architecture for an IoT processing workload. The architecture includes a virtual network named VNet1 that contains a subnet hosting virtual machines. The virtual machines must make outbound connections to specific external fully qualified domain names (FQDNs) on the internet, such as *.api.weather.com and registry.npmjs.org, to fetch environmental data and software updates. The design must filter outbound traffic based on these FQDNs and support wildcard routing while minimizing administrative effort. Which component should you recommend including in the design?

Show answer & explanation

Answer: Azure Firewall deployed in VNet1, with application rules configured to allow outbound traffic to the required fully qualified domain names.

Answer

Azure Firewall deployed in VNet1, with application rules configured to allow outbound traffic to the required fully qualified domain names.
The correct answer is the option recommending Azure Firewall with application rules. Azure Firewall operates as a fully managed cloud-based network security service that protects your Azure Virtual Network resources. Its application rules allow you to configure fully qualified domain names (FQDNs) that can be accessed from a subnet, which naturally supports wildcard configurations like '*.api.weather.com'. This satisfies both the security filtering requirement and the administrative overhead constraint.

Step-by-Step Solution

1
Analyze the technical requirements: outbound traffic must be filtered by specific fully qualified domain names (FQDNs) and support wildcards (e.g., *.api.weather.com) with minimal administrative effort.
Identify that Network Security Groups (NSGs) and User Defined Routes (UDRs) cannot inspect or filter application-layer FQDNs directly.
NSGs and UDRs operate at the network and transport layers (Layers 3 and 4) and do not support dynamic wildcard FQDN filtering.
2
Evaluate the capabilities of Azure Firewall.
Confirm that Azure Firewall application rules are designed to filter outbound HTTP, HTTPS, and MSSQL traffic using FQDNs, including wildcard prefixes.
Azure Firewall provides built-in application-layer filtering to meet the requirement.
3
Evaluate administrative overhead of the options.
Azure Firewall is a managed service that automatically updates backend infrastructure and requires no manual maintenance of IP address changes for the external services.
This satisfies the requirement to minimize administrative effort.

Key Concept

Azure Firewall Application Rules for Outbound FQDN Filtering
Question 1139Question →

An enterprise is designing a regional application delivery and load balancing solution in the East US region. The architecture must support two workloads deployed on Azure Virtual Machines:

1. An HTTPS web application requiring SSL/TLS termination and URL path-based routing (routing `/images/*` and `/video/*` to separate backend pools).
2. A legacy database replication service that communicates using raw TCP on port 1433 and requires low-latency, high-throughput load balancing.

All virtual machines are configured with Standard SKU Public IP addresses for administrative access.

Which two Azure load balancing services should you include in the design to meet these requirements without validation failures? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Application Gateway (Standard v2 SKU) to route the HTTPS web application traffic; Azure Load Balancer (Standard SKU) to route the legacy database replication traffic

Answer

Azure Application Gateway (Standard v2 SKU) to handle the HTTPS web application traffic and Azure Load Balancer (Standard SKU) to handle the legacy database replication traffic.
The correct solution includes Azure Application Gateway (Standard v2 SKU) and Azure Load Balancer (Standard SKU). Azure Application Gateway operates at Layer 7, satisfying the requirements for SSL/TLS termination and URL path-based routing. Azure Load Balancer operates at Layer 4, satisfying the requirement for low-latency TCP routing on port 1433. The Standard SKU Load Balancer is required to ensure compatibility with the virtual machines' Standard SKU Public IP addresses.

Step-by-Step Solution

1
Analyze Layer 7 requirements
The HTTPS web application requires SSL/TLS termination and URL path-based routing. These features require a Layer 7 load balancer.
Azure Application Gateway handles HTTP/HTTPS Layer 7 load balancing and URL path-based routing rules.
2
Analyze Layer 4 requirements
The legacy database replication service uses raw TCP on port 1433, which requires a Layer 4 load balancer.
Azure Load Balancer handles Layer 4 TCP/UDP traffic.
3
Check SKU constraints for the Layer 4 load balancer
Since the backend virtual machines use Standard SKU Public IP addresses, the Azure Load Balancer must also be the Standard SKU.
Mixing Basic and Standard SKUs in a virtual machine's network interface associations (such as Public IP and Load Balancer) is not supported and causes validation failures.

Key Concept

Selecting and combining Azure load balancing services based on layer capabilities (Layer 7 Application Gateway for HTTP/HTTPS routing vs. Layer 4 Load Balancer for non-HTTP TCP/UDP) and enforcing SKU alignment (Standard SKU) across public IPs and load balancers.
Question 1140Question →

A company plans to migrate its on-premises customer relationship management (CRM) application, currently hosted on Hyper-V virtual machines, to Azure. The on-premises environment consists of the following components:
- Three web servers running IIS that communicate frequently with the database.
- A backend database server running SQL Server 2022 that relies heavily on SQL Server Agent jobs and cross-database queries.
- An identity structure where users authenticate against the local Active Directory Domain Services (AD DS). The company does not use smart cards and has no requirement for federated identity.

You need to design the migration assessment and target architecture to ensure zero disruption in database compatibility and identity integration, while also mapping server interdependencies.

Which two actions should you include in your recommendation? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Recommend Azure SQL Managed Instance as the migration target for the SQL Server database to maintain support for cross-database queries and SQL Server Agent jobs.; Use Azure Migrate dependency analysis to map all network connections and interdependencies for the Hyper-V virtual machines before planning the migration groups.

Answer

Recommending Azure SQL Managed Instance ensures compatibility for cross-database queries and SQL Server Agent jobs. Utilizing Azure Migrate dependency analysis maps VM dependencies to prevent network latency and disconnects during migration.
Selecting Azure SQL Managed Instance ensures compatibility for cross-database queries and SQL Server Agent jobs. Performing dependency analysis in Azure Migrate identifies all interconnected application components to ensure a seamless migration without network disconnects.

Step-by-Step Solution

1
Analyze database feature requirements
Identify that the backend SQL Server requires cross-database queries and SQL Server Agent jobs.
This constraints the target relational database service options in Azure.
2
Evaluate Azure SQL migration targets
Select Azure SQL Managed Instance because it supports instance-level features like SQL Server Agent and cross-database queries, whereas Azure SQL Database single database does not.
To ensure database compatibility without modifying application code.
3
Evaluate VM assessment strategy
Run dependency analysis within Azure Migrate to identify network communication between the IIS web servers and the backend database.
To prevent high latency or connection loss by keeping dependent VMs in the same migration group.
4
Evaluate identity requirements
Rule out AD FS as the primary recommendation since there is no requirement for federation, meaning a simpler sync mechanism like Microsoft Entra Connect with PHS is optimal.
To reduce design complexity and operational overhead.

Key Concept

Azure Migrate dependency mapping and database target alignment based on legacy SQL feature dependencies.
PreviousPage 57 / 60Next