All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

A digital media company is designing the Azure compute infrastructure for a new video rendering and encoding platform. The platform consists of two main components:

1. An orchestration portal that manages rendering jobs, user profiles, and subscription details. This portal represents a steady-state production workload and requires a $99.9\%$ availability SLA.
2. A batch processing layer containing multiple worker instances that execute the CPU-intensive rendering tasks. These tasks write progress checkpoints to Azure Blob Storage, allowing interrupted jobs to resume from the last checkpoint.

You need to minimize compute costs for both layers while meeting the availability requirements.

Which two Azure compute configurations should you recommend?

Select all that apply

Azure Spot Virtual Machines to host the batch processing worker instances

Standard Azure Virtual Machines combined with Azure Reserved Virtual Machine Instances to host the orchestration portal

Azure Spot Virtual Machines to host the orchestration portal to minimize steady-state compute costs

Multiple standard Azure Virtual Machines deployed within a single Availability Zone to host the orchestration portal

Show answer & explanation

Answer: Azure Spot Virtual Machines to host the batch processing worker instances; Standard Azure Virtual Machines combined with Azure Reserved Virtual Machine Instances to host the orchestration portal

Answer

Azure Spot Virtual Machines to host the batch processing worker instances, and Standard Azure Virtual Machines combined with Azure Reserved Virtual Machine Instances to host the orchestration portal.

The correct configurations align the workload requirements with the appropriate Azure compute features. The rendering workers write progress checkpoints and can tolerate interruption, making them ideal candidates for the cost-effective Azure Spot VMs. Conversely, the orchestration portal represents a steady-state production workload with a

99.9\%

SLA constraint, requiring standard VM instances. Applying Azure Reserved Instances to these standard VMs is the correct way to reduce costs without risking eviction.

Step-by-Step Solution

Analyze the workload characteristics and SLA requirements for the orchestration portal.

The orchestration portal requires a steady-state production environment with a

99.9\%

availability SLA, meaning it cannot tolerate evictions.

This rules out Spot VMs for this layer and necessitates standard VMs. Since it is a steady-state, predictable workload, Azure Reserved Virtual Machine Instances should be used to minimize costs.

Analyze the workload characteristics and fault tolerance of the batch processing layer.

The rendering workers perform CPU-intensive tasks that checkpoint progress and can tolerate interruptions.

Because the workload is interruptible, Azure Spot VMs are the most cost-effective option, offering up to a

90\%

discount compared to pay-as-you-go rates.

Evaluate high availability design for the orchestration portal.

Deploying VMs across multiple Availability Zones or using zone-redundant VMSS configurations is required for resiliency against zone outages.

Placing all VMs in a single Availability Zone exposes the application to zone-level failures, which does not align with best practices for high availability.

Key Concept

Selecting cost-effective and resilient Azure compute solutions based on workload characteristics, SLA requirements, and fault tolerance.

Question 1142Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-eastus` ( $10.10.0.0/16$ ), hosts an Azure Firewall with the private IP address $10.10.1.4$ . A spoke virtual network, `vnet-prod-spoke` ( $10.20.0.0/16$ ), is peered with the hub virtual network. The enterprise has multiple other spoke virtual networks deployed within the $10.0.0.0/8$ address space.

You need to design a routing solution for `vnet-prod-spoke` that meets the following requirements:
- All traffic destined for the internet must be inspected by the Azure Firewall.
- All traffic destined for other spoke virtual networks within the $10.0.0.0/8$ range must be inspected by the Azure Firewall.
- Traffic between subnets within `vnet-prod-spoke` must route directly between the subnets and bypass the firewall.

Which two routing configurations should you implement in the user-defined route (UDR) table associated with the subnets in `vnet-prod-spoke`? (Select two.)

Select all that apply

A route for

0.0.0.0/0

with the next hop set to the Virtual Appliance IP address

10.10.1.4

A route for

10.0.0.0/8

with the next hop set to the Virtual Appliance IP address

10.10.1.4

A route for

10.20.0.0/16

with the next hop set to the Virtual Appliance IP address

10.10.1.4

A route for

10.20.0.0/24

with the next hop set to the Virtual Appliance IP address

10.10.1.4

Show answer & explanation

Answer: A route for $0.0.0.0/0$ with the next hop set to the Virtual Appliance IP address $10.10.1.4$ ; A route for $10.0.0.0/8$ with the next hop set to the Virtual Appliance IP address $10.10.1.4$

Answer

The correct configurations are to add a route for

0.0.0.0/0

pointing to the Azure Firewall private IP address, and a route for

10.0.0.0/8

pointing to the Azure Firewall private IP address.

To inspect internet-bound traffic, a default route for

0.0.0.0/0

must point to the Azure Firewall private IP address. To inspect spoke-to-spoke traffic without routing internal spoke traffic to the firewall, a user-defined route for the wider

10.0.0.0/8

prefix pointing to the firewall is used. Azure's Longest Prefix Match routing algorithm ensures that local spoke traffic destined for the

10.20.0.0/16

range matches the more specific system route (

10.20.0.0/16

-> Virtual Network) rather than the custom route, allowing local traffic to bypass the firewall.

Step-by-Step Solution

Analyze the traffic requirements and routing precedence in Azure.

Azure routes traffic using the Longest Prefix Match (LPM) algorithm. User-defined routes (UDRs) override system routes of the same prefix length, but a more specific system route will still take precedence over a less specific UDR.

Understanding LPM is critical to designing routes that selectively intercept traffic without overriding necessary local traffic paths.

Evaluate the configuration for internet-bound traffic.

A default route (

0.0.0.0/0

) pointing to the Azure Firewall (

10.10.1.4

) is required to direct all outbound internet traffic to the hub for inspection.

This satisfies the requirement to inspect all internet-bound traffic.

Evaluate the configuration for spoke-to-spoke traffic while preserving local routing.

A route for

10.0.0.0/8

pointing to the Azure Firewall (

10.10.1.4

) directs traffic destined for other virtual networks in that range to the firewall. Since the local spoke virtual network system route (

10.20.0.0/16

) has a longer prefix length than

10.0.0.0/8

, intra-spoke traffic continues to use the system local route, bypassing the firewall.

This satisfies both the spoke-to-spoke inspection requirement and the local spoke bypass requirement.

Key Concept

Azure routing priority and Longest Prefix Match (LPM) interaction with User Defined Routes (UDR).

Estimated Time:2m 0s

Question 1143Question →

An organization is planning to migrate an on-premises retail inventory system hosted on a VMware vSphere environment to Azure. The system consists of five web servers and a cluster of database servers. A strict security policy prohibits the installation of any software agents on the virtual machines during the assessment phase. You need to use Azure Migrate to discover the virtual machines, map their network dependencies, and assess their readiness for Azure.

Which two actions should you include in the assessment strategy? Choose two.

Select all that apply

Deploy the Azure Migrate appliance as a VMware Open Virtualization Appliance (OVA) template on-premises.

Enable agentless dependency analysis and add guest operating system credentials to the Azure Migrate appliance.

Install the Microsoft Monitoring Agent (MMA) and the Dependency agent on all virtual machines.

Configure an Active Directory Federation Services (AD FS) infrastructure to authorize the dependency tracking connection.

Deploy a dedicated Azure SQL Database singleton to store and process the schema assessment reports.

Show answer & explanation

Answer: Deploy the Azure Migrate appliance as a VMware Open Virtualization Appliance (OVA) template on-premises.; Enable agentless dependency analysis and add guest operating system credentials to the Azure Migrate appliance.

Answer

Deploy the Azure Migrate appliance as a VMware Open Virtualization Appliance (OVA) template on-premises and enable agentless dependency analysis by adding guest operating system credentials to the Azure Migrate appliance.

Deploying the Azure Migrate appliance as a VMware Open Virtualization Appliance (OVA) template is the standard, agentless way to discover virtual machines on VMware vSphere. To analyze network dependencies without software agents, agentless dependency analysis must be configured. This requires adding guest operating system credentials to the Azure Migrate appliance so that it can query network connections via VMware Tools APIs.

Step-by-Step Solution

Analyze constraints and requirements.

Identified VMware vSphere hypervisor, requirement for agentless discovery, and requirement for dependency mapping without VM agents.

This establishes that only agentless mechanisms supported by Azure Migrate for VMware can be used.

Select the discovery method.

Choose the Azure Migrate appliance deployed via an OVA template.

The VMware OVA template is the standard, agentless method to deploy the Azure Migrate appliance in vSphere environments.

Select the dependency analysis method.

Choose agentless dependency analysis with VM guest credentials configured in the appliance.

Agentless dependency analysis uses VMware Tools and guest OS credentials to discover active network connections without installing agents on the VMs.

Key Concept

Azure Migrate agentless discovery and dependency mapping for VMware environments

Question 1144Question →

A smart-grid utility provider is designing a telemetry ingestion system in the West US 3 region to collect real-time status updates from smart meters using a custom TCP protocol on port 8080. The design must satisfy the following requirements:
- Distribute incoming TCP traffic on port 8080 across a backend pool of virtual machines.
- Support high availability with zone-redundancy across three availability zones.
- Support the existing backend virtual machines, which currently have Basic SKU Public IP addresses assigned to their network interfaces.

Which of the following actions should you recommend to meet these requirements?

Upgrade the virtual machines' public IP addresses to Standard SKU (or remove them), and deploy a Standard Load Balancer to distribute the TCP traffic.

Deploy a Standard Load Balancer to distribute the TCP traffic, and associate the backend virtual machines without modifying their existing Basic SKU public IP addresses.

Deploy a Basic Load Balancer to route the TCP traffic, and deploy all backend virtual machines in a single availability zone to accommodate the Basic SKU public IP addresses.

Deploy Azure Traffic Manager with a performance routing method to distribute the TCP traffic directly to the virtual machines across the availability zones.

Show answer & explanation

Answer: Upgrade the virtual machines' public IP addresses to Standard SKU (or remove them), and deploy a Standard Load Balancer to distribute the TCP traffic.

Answer

Upgrade the virtual machines' public IP addresses to Standard SKU (or remove them), and deploy a Standard Load Balancer to distribute the TCP traffic.

To support zone-redundancy across three availability zones, Azure Standard Load Balancer must be used because Basic Load Balancer is not zone-aware. However, Azure networking rules state that you cannot mix Basic and Standard SKU resources on the same virtual machine network interface. Therefore, the existing Basic SKU public IP addresses must be upgraded to Standard SKU (or removed) before the virtual machines can join the Standard Load Balancer backend pool.

Step-by-Step Solution

Identify the protocol and zonal requirements.

The application requires regional load balancing for custom TCP traffic on port 8080 across three availability zones.

Azure Standard Load Balancer supports Layer 4 TCP/UDP protocols and offers zone-redundant frontend configurations, whereas Basic Load Balancer is not zone-aware.

Check the SKU constraints for the public IP addresses on the backend virtual machines.

The existing virtual machines have Basic SKU Public IPs, which cannot be mixed with a Standard Load Balancer backend pool.

Azure enforces SKU consistency: a virtual machine network interface associated with a Standard Load Balancer backend pool cannot have Basic SKU public IP addresses.

Select the correct upgrade path to resolve the SKU conflict.

Upgrade the public IPs to Standard SKU or remove them, and deploy the Standard Load Balancer.

This resolves the SKU mismatch validation error while enabling the Standard Load Balancer to provide zone-redundancy.

Key Concept

Azure Load Balancer SKU alignment and zone-redundancy constraints

Question 1145Question →

An energy utility company is designing the Azure compute infrastructure for two distinct workloads:

* Workload 1: A smart-meter telemetry ingestion service that runs 24/7, requires a 99.99% availability SLA, and must allow individual virtual machines to be patched and managed independently.
* Workload 2: A monthly billing simulation report that takes 6 hours to run, can tolerate interruptions, and must be completed at the lowest possible compute cost.

Which two virtual machine configurations should you recommend to meet these requirements?

Select all that apply

Deploy virtual machines using Virtual Machine Scale Sets in Flexible orchestration mode across multiple Availability Zones for Workload 1.

Deploy virtual machines as Azure Spot Virtual Machines for Workload 2.

Deploy virtual machines as Azure Spot Virtual Machines for Workload 1.

Deploy all virtual machines within a single Availability Zone using an Availability Set for Workload 1.

Show answer & explanation

Answer: Deploy virtual machines using Virtual Machine Scale Sets in Flexible orchestration mode across multiple Availability Zones for Workload 1.; Deploy virtual machines as Azure Spot Virtual Machines for Workload 2.

Answer

To meet the requirements, the smart-meter telemetry service should be deployed using Virtual Machine Scale Sets in Flexible orchestration mode across multiple Availability Zones, and the billing simulation report should be run on Azure Spot Virtual Machines.

The telemetry ingestion service requires a 99.99% SLA, which can only be achieved by distributing instances across multiple Availability Zones. Flexible orchestration mode provides the ability to manage, patch, and control individual virtual machines independently, which satisfies the operational requirement. The billing simulation workload is interruptible and cost-sensitive, making Azure Spot VMs the most appropriate and cost-effective solution.

Step-by-Step Solution

Analyze the availability and management requirements for the smart-meter telemetry service.

The workload requires a 99.99% availability SLA and individual virtual machine management.

Determining the high availability and orchestration requirements helps select the correct deployment model.

Determine the optimal high availability deployment option for the telemetry service.

Multiple Availability Zones are required to achieve the 99.99% SLA, and Flexible orchestration mode is required for individual virtual machine control.

Uniform orchestration mode does not allow the same level of granular management for individual virtual machines, and a single availability zone only offers a 99.95% SLA.

Analyze the cost and interruption tolerance for the billing simulation report.

The workload is interruptible, runs for a limited time, and must minimize costs.

This determines whether discounted, non-guaranteed compute options like Spot VMs can be utilized.

Select the compute model for the billing simulation.

Azure Spot VMs are the most cost-effective option for non-critical, interruptible batch processing.

Spot VMs offer up to a 90% discount compared to pay-as-you-go rates, satisfying the budget constraint since the workload can tolerate evictions.

Key Concept

Designing highly available, cost-effective compute solutions using Virtual Machine Scale Sets and Azure Spot VMs based on application SLA and interruption tolerance.

Question 1146Question →

A company is planning to migrate a legacy inventory application to Azure. The application's frontend web tier runs on VMware vSphere virtual machines, while its backend Microsoft SQL Server database runs on a dedicated physical Windows server cluster. The SQL Server database relies on cross-database queries and SQL Server Agent jobs. All servers are located in a secure network zone with no direct internet access, but they can route traffic through an outbound HTTPS proxy. You need to design an Azure Migrate assessment to map the application's network dependencies and determine the correct target database tier in Azure. Which two actions should you include in the assessment design? (Choose two.)

Select all that apply

Install the Azure Monitor Agent and the Dependency Agent on the physical SQL Server machines to map dependencies.

Enable agentless dependency mapping on the physical SQL Server machines by deploying the Azure Migrate appliance.

Assess the SQL Server database for migration to Azure SQL Managed Instance.

Recommend Azure SQL Database elastic pools as the target for the SQL Server database migration.

Deploy Active Directory Federation Services (AD FS) on-premises to support identity synchronization to Microsoft Entra ID.

Show answer & explanation

Answer: Install the Azure Monitor Agent and the Dependency Agent on the physical SQL Server machines to map dependencies.; Assess the SQL Server database for migration to Azure SQL Managed Instance.

Answer

Installing the Azure Monitor Agent and Dependency Agent on the physical SQL Server machines to map dependencies, and assessing the SQL Server workload for migration to Azure SQL Managed Instance.

The correct strategy involves installing the Azure Monitor Agent and Dependency Agent on the physical servers, and assessing the SQL database for migration to Azure SQL Managed Instance. Physical servers do not support agentless dependency analysis in Azure Migrate, making the installation of agents necessary to map dependencies. Additionally, because the legacy database relies on SQL Server Agent jobs and cross-database queries, it must be migrated to Azure SQL Managed Instance, as Azure SQL Database does not support these features.

Step-by-Step Solution

Analyze the database requirements.

Identify that the database relies on cross-database queries and SQL Server Agent jobs.

These features dictate which Azure SQL database service tier must be selected for compatibility.

Select the appropriate Azure SQL service tier.

Determine that Azure SQL Managed Instance is the required target database tier.

Azure SQL Database single database and elastic pools do not support SQL Server Agent or cross-database queries, making Azure SQL Managed Instance the minimum compatible fully managed tier.

Analyze the virtualization environment for dependency mapping.

Identify that the database runs on physical servers, whereas the web tier runs on VMware VMs.

Azure Migrate has different dependency mapping capabilities depending on whether the source server is a virtual machine or a physical server.

Determine the dependency mapping method for the physical servers.

Select agent-based dependency mapping by installing the Azure Monitor Agent and Dependency Agent.

Azure Migrate does not support agentless dependency mapping for physical servers; agentless mapping is restricted to VMware and Hyper-V VMs.

Key Concept

Designing a migration assessment strategy that accounts for physical server dependency mapping limitations and database platform feature compatibility.

Estimated Time:2m 30s

Question 1147Question →

A company is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-prod` ( $172.30.0.0/16$ ), contains an Azure Firewall ( $172.30.0.4$ ) and a Virtual Network Gateway that connects to an on-premises network via ExpressRoute. The spoke virtual network, `vnet-spoke-app` ( $10.80.0.0/16$ ), contains a subnet named `snet-web` ( $10.80.1.0/24$ ) and is peered with `vnet-hub-prod` with gateway transit enabled. The on-premises network advertises the prefix $10.200.0.0/16$ via BGP. To comply with security policies, all traffic from `snet-web` to the on-premises network must be inspected by the Azure Firewall. An architect associates a route table with `snet-web` and adds a User Defined Route (UDR) for $10.0.0.0/8$ pointing to the Azure Firewall. However, during testing, traffic from `snet-web` to the on-premises network bypasses the firewall and is routed directly to the gateway. Which of the following actions should the architect take to resolve this issue?

Disable virtual network gateway route propagation on the route table associated with `snet-web`.

Configure a User Defined Route (UDR) for

10.80.0.0/16

pointing to the Azure Firewall.

Add a User Defined Route (UDR) for

10.200.0.0/16

with the next hop set to the Virtual Network Gateway.

Change the next hop type of the

10.0.0.0/8

User Defined Route (UDR) to Virtual Network Gateway.

Show answer & explanation

Answer: Disable virtual network gateway route propagation on the route table associated with `snet-web`.

Answer

Disable virtual network gateway route propagation on the route table associated with the spoke subnet.

Disabling route propagation on the route table associated with the spoke subnet prevents the Virtual Network Gateway from injecting the on-premises BGP-learned routes (such as the specific

10.200.0.0/16

prefix) into the subnet's routing table. In Azure, User Defined Routes (UDRs) take precedence over system routes and BGP routes only if their prefixes are identical or if the UDR has a longer prefix match. Since the propagated route (

10.200.0.0/16

) is more specific than the UDR (

10.0.0.0/8

), the traffic matches the BGP route and bypasses the firewall. Disabling route propagation removes the

10.200.0.0/16

route, causing the traffic to fall back to the

10.0.0.0/8

UDR, which successfully routes it through the Azure Firewall.

Step-by-Step Solution

Analyze how the routing table for the subnet determines the next hop.

Azure uses Longest Prefix Match (LPM) to choose routes. Currently, the subnet table contains a BGP-propagated route for

10.200.0.0/16

(next hop: Gateway) and a UDR for

10.0.0.0/8

(next hop: Virtual Appliance).

Understanding why the traffic bypasses the firewall is necessary to identify the corrective action.

Evaluate the match priority of the destination IP addresses.

Since

10.200.0.0/16

is a longer prefix match than

10.0.0.0/8

, traffic destined for on-premises matches the BGP-learned route and bypasses the UDR pointing to the firewall.

This identifies that BGP route propagation is introducing a more specific prefix that overrides the security intent of the UDR.

Select the configuration change that removes the specific BGP routes from the spoke subnet.

Disabling gateway route propagation on the route table removes the

10.200.0.0/16

route from the subnet's routing table, forcing the traffic to match the

10.0.0.0/8

UDR and flow to the firewall.

Disabling route propagation allows the broader UDR to take effect for the on-premises range without having to define manual UDRs for every propagated prefix.

Key Concept

Azure routing priority, Longest Prefix Match (LPM), and Gateway Route Propagation

Estimated Time:2m 0s

Question 1148Question →

A logistics enterprise plans to migrate a multi-tier distribution application from an on-premises VMware vSphere environment to Azure. You need to design an Azure Migrate assessment strategy that maps network dependencies between the virtual machines to determine optimal migration waves. The enterprise security policy imposes the following constraints:
- No software agents can be installed on the application virtual machines.
- The use of domain administrator or root credentials for guest operating system access is strictly prohibited.

Which dependency mapping strategy should you recommend?

Configure agentless dependency analysis in Azure Migrate by utilizing guest operating system credentials that have standard user permissions or non-root SSH access.

Deploy the Azure Migrate appliance and configure agent-based dependency analysis by installing the Dependency Agent and Microsoft Monitoring Agent on each virtual machine.

Configure agentless dependency analysis in Azure Migrate by providing domain administrator credentials for Windows virtual machines and root credentials for Linux virtual machines.

Establish a Microsoft Entra Domain Services managed domain to synchronize on-premises identity credentials and authorize the dependency scanning process.

Show answer & explanation

Answer: Configure agentless dependency analysis in Azure Migrate by utilizing guest operating system credentials that have standard user permissions or non-root SSH access.

Answer

Configure agentless dependency analysis in Azure Migrate by utilizing guest operating system credentials that have standard user permissions or non-root SSH access.

The correct option is to use agentless dependency analysis in Azure Migrate using standard guest operating system credentials with minimum privileges. Azure Migrate agentless dependency analysis for VMware VMs does not install any agents on the virtual machines. For Windows, it can use a local or domain user account with standard permissions (granted WMI/COM access), and for Linux, it can use a standard user account with SSH access, satisfying both security constraints.

Step-by-Step Solution

Analyze the security constraints regarding agent installation and credential access permissions.

Identified that any solution requiring VM-level agents or domain administrator/root credentials must be excluded.

Ensures design compliance with enterprise security requirements.

Evaluate Azure Migrate dependency mapping capabilities for VMware vSphere virtual machines.

Agentless dependency analysis is selected since it does not install agents and retrieves network connection data via the hypervisor and guest OS APIs.

Allows mapping of dependencies without software footprint on the target VMs.

Determine the minimum privilege requirements for guest OS access in agentless dependency analysis.

Confirmed that Windows virtual machines require either local/domain administrator or a standard user with specific WMI/COM permissions, and Linux virtual machines require a standard user with SSH access (no root required).

Meets the constraint forbidding domain administrator and root accounts.

Key Concept

Azure Migrate agentless dependency analysis for VMware workloads allows mapping network connections without VM agents or highly privileged guest OS credentials (domain admin/root).

Estimated Time:1m 30s

Question 1149Question →

A national education board is designing the application delivery and load balancing architecture for its regional virtual learning management system (LMS) in the East US region. The virtual machines (VMs) hosting the system are deployed across multiple Availability Zones to ensure high availability. The architecture must satisfy the following requirements:
1. Distribute incoming UDP-based video streaming traffic across the backend VMs.
2. Route HTTPS-based web portal traffic, including offloading SSL/TLS termination and routing requests with the path '/assignments/*' to a dedicated virtual machine scale set.
3. The backend virtual machines currently have Basic SKU Public IP addresses associated with their network interfaces for direct administrative access.

Which two of the following components and configurations should you include in the design to meet these requirements?

Select all that apply

An Azure Application Gateway (Standard v2 SKU) to handle the HTTPS-based web portal traffic and route requests based on URL paths.

An Azure Load Balancer (Standard SKU) to distribute the UDP-based streaming traffic, after upgrading the virtual machines' Public IP addresses to Standard SKU.

An Azure Load Balancer (Basic SKU) to distribute the UDP-based streaming traffic, allowing the virtual machines to keep their existing Basic SKU Public IP addresses.

Azure Traffic Manager to manage the HTTPS-based web portal traffic, perform SSL termination, and route requests based on URL paths.

Show answer & explanation

Answer: An Azure Application Gateway (Standard v2 SKU) to handle the HTTPS-based web portal traffic and route requests based on URL paths.; An Azure Load Balancer (Standard SKU) to distribute the UDP-based streaming traffic, after upgrading the virtual machines' Public IP addresses to Standard SKU.

Answer

An Azure Application Gateway (Standard v2 SKU) to handle HTTPS-based web portal traffic and route requests based on URL paths, and an Azure Load Balancer (Standard SKU) to distribute UDP-based streaming traffic after upgrading the virtual machines' Public IP addresses to Standard SKU.

The correct architecture uses an Azure Application Gateway (Standard v2 SKU) to handle the HTTPS-based web portal traffic because it operates at Layer 7, providing path-based routing and SSL termination. It also uses a Standard Azure Load Balancer to distribute the UDP-based streaming traffic. Since the VMs are deployed across multiple Availability Zones, the Standard Load Balancer is required (as Basic Load Balancer does not support Availability Zones). To avoid SKU mismatch validation failures, the virtual machines' existing Basic SKU Public IPs must be upgraded to Standard SKU.

Step-by-Step Solution

Analyze protocol and routing requirements for the web portal.

The web portal requires HTTPS routing, SSL termination, and path-based routing (e.g., routing `/assignments/*` to a dedicated VM scale set). Since these are Layer 7 application routing capabilities, Azure Application Gateway is the correct resource.

Azure Application Gateway operates at Layer 7 and supports SSL offloading and path-based routing rules.

Analyze protocol requirements for the live video streaming.

The video streaming uses UDP. This requires a Layer 4 load balancer. Azure Load Balancer supports TCP and UDP traffic.

Azure Load Balancer operates at Layer 4 and can distribute non-HTTP/S traffic like UDP.

Verify SKU compatibility and Availability Zone requirements.

The virtual machines are deployed across multiple Availability Zones, which requires the Standard SKU of Azure Load Balancer. However, Standard Load Balancer backend pools only support Standard SKU resources. The virtual machines' network interfaces currently have Basic SKU Public IP addresses, which causes a validation error due to SKU mismatch.

To use Standard Load Balancer, all associated Public IP addresses on the virtual machines' network interfaces must be upgraded from Basic SKU to Standard SKU.

Key Concept

Application Load Balancing and Delivery

Estimated Time:2m 0s

Question 1150Question →

An organization plans to migrate a legacy line-of-business (LOB) application currently running on on-premises physical bare-metal servers to Azure Virtual Machines. The application has multiple undocumented network connections to other local servers. The organization needs to map these dependencies before scheduling the migration. Additionally, you must design a hybrid identity solution to synchronize on-premises user accounts to Microsoft Entra ID while minimizing operational overhead and ensuring that user passwords can be managed on-premises. Which two actions should you include in the migration assessment and strategy? (Choose two.)

Select all that apply

Install the Azure Monitor agent and the Dependency agent on each physical server.

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS).

Deploy Active Directory Federation Services (AD FS) to establish federation with Microsoft Entra ID.

Configure agentless dependency analysis on the physical servers using the Azure Migrate appliance.

Deploy Azure SQL Database single databases to host databases that require cross-database queries.

Show answer & explanation

Answer: Install the Azure Monitor agent and the Dependency agent on each physical server.; Configure Microsoft Entra Connect with Password Hash Synchronization (PHS).

Answer

To successfully perform the migration assessment and design the identity solution, you must install the Azure Monitor agent and the Dependency agent on each physical server, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS).

Installing the Azure Monitor agent and the Dependency agent is correct because physical bare-metal servers do not support agentless dependency analysis in Azure Migrate, making the agent-based approach necessary. Configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) is correct because it synchronizes user accounts and passwords to the cloud with the least operational overhead, avoiding the maintenance costs of dedicated federation infrastructure.

Step-by-Step Solution

Determine the dependency analysis method for physical bare-metal servers.

Since agentless dependency analysis is not supported for physical servers in Azure Migrate, agent-based dependency analysis must be used.

Agent-based dependency analysis requires installing the Azure Monitor agent (or Log Analytics agent) and the Dependency agent on each server to map TCP connections.

Select the hybrid identity mechanism that satisfies constraints.

Password Hash Synchronization (PHS) is selected as it synchronizes identities, enforces on-premises policies, and has the lowest operational overhead compared to Pass-through Authentication (PTA) or AD FS.

Active Directory Federation Services (AD FS) is rejected because it introduces high infrastructure complexity and administrative overhead.

Key Concept

Azure Migrate dependency analysis methods vary by platform; physical servers require agent-based mapping, while hybrid identity designs should prioritize Password Hash Synchronization (PHS) over AD FS for lower operational overhead unless federation is explicitly required.

Question 1151Question →

A healthcare provider is designing the regional application delivery and load balancing architecture in East US 2 for a new clinical portal. The solution must meet the following requirements:
- The public-facing web application requires SSL/TLS termination and path-based routing (traffic for `/patients/*` and `/staff/*` must be routed to separate backend pools).
- The database synchronization layer requires high-throughput TCP connections on custom port $5000$ .
- All database virtual machines currently use Basic SKU Public IP addresses for administration.
- To comply with strict data sovereignty regulations, all load balancing and traffic routing components must reside entirely within the East US 2 region.

Which load balancing configuration should you recommend?

Deploy an Azure Application Gateway (Standard v2) for the web application, deploy an Azure Standard Load Balancer for the database layer, and upgrade the database virtual machines' public IP addresses to the Standard SKU.

Deploy an Azure Application Gateway (Standard v2) for the web application, deploy an Azure Standard Load Balancer for the database layer, and retain the Basic SKU public IP addresses on the database virtual machines.

Deploy an Azure Traffic Manager profile to handle SSL/TLS termination and path-based routing for the web application, and deploy an Azure Standard Load Balancer for the database layer after upgrading the database virtual machines' public IP addresses to the Standard SKU.

Deploy an Azure Front Door Premium profile to manage both the web application and the database layer TCP connections on port

5000

using path-based routing rules.

Show answer & explanation

Answer: Deploy an Azure Application Gateway (Standard v2) for the web application, deploy an Azure Standard Load Balancer for the database layer, and upgrade the database virtual machines' public IP addresses to the Standard SKU.

Answer

The correct configuration uses Azure Application Gateway (Standard v2) to satisfy the layer-7 features (SSL/TLS termination and path-based routing) for the web application. It uses Azure Standard Load Balancer to load balance the custom TCP traffic on port

5000

for the database layer. Finally, it upgrades the database virtual machines' public IP addresses to the Standard SKU to resolve the SKU mismatch validation error that occurs when mixing Basic SKU public IPs with a Standard Load Balancer.

Step-by-Step Solution

Analyze the web application requirements.

The web application requires SSL/TLS termination and regional path-based routing (`/patients/*` and `/staff/*`), which requires a regional layer-7 load balancer like Azure Application Gateway.

Azure Application Gateway operates at layer 7 and supports SSL offloading and URL-based routing rules.

Analyze the database synchronization requirements.

The database layer requires high-throughput TCP load balancing on port

5000

, which requires a regional layer-4 load balancer like Azure Standard Load Balancer.

Azure Standard Load Balancer provides low-latency, high-throughput Layer 4 load balancing for TCP/UDP protocols on arbitrary ports.

Verify SKU compatibility requirements.

The database virtual machines' public IP addresses must be upgraded from Basic to Standard SKU.

Azure Standard Load Balancer requires all backend network interfaces to have Standard SKU public IPs (or no public IPs). Mixing Basic and Standard SKUs in this load balancer configuration is not supported.

Key Concept

Selecting and configuring regional Azure load balancing services (Application Gateway and Standard Load Balancer) while ensuring SKU compatibility for backend pools.

Question 1152Question →

A pharmaceutical company is designing the Azure compute infrastructure to host a molecular modeling simulation application. The simulations run continuously for up to 72 hours. If a virtual machine is interrupted or terminated during a run, the progress is lost, and the entire simulation must restart from the beginning. The application requires high-performance CPU capabilities and low-latency node-to-node communication. The finance team recommends using Azure Spot virtual machines to minimize compute costs. Which compute virtualization strategy should you recommend to meet the requirements of the simulation application?

Deploy the simulation application on H-series Azure Spot virtual machines.

Deploy the simulation application as serverless tasks using Azure Functions on a Consumption plan.

Deploy the simulation application on standard H-series virtual machines.

Deploy the simulation application on D-series Azure Spot virtual machines.

Show answer & explanation

Answer: Deploy the simulation application on standard H-series virtual machines.

Answer

Deploy the simulation application on standard H-series virtual machines.

Deploying the simulation application on standard H-series virtual machines is the correct strategy because H-series virtual machines are optimized for High-Performance Computing (HPC) workloads, providing the necessary CPU performance and low-latency InfiniBand networking. Standard VMs do not have an eviction policy, guaranteeing that the 72-hour simulation runs will complete without interruption.

Step-by-Step Solution

Analyze the workload characteristics and requirements.

The application requires continuous execution for up to 72 hours with no tolerance for interruption, high-performance CPU, and low-latency node-to-node communication.

Identifying these constraints helps filter out compute options that fail to meet availability and performance needs.

Evaluate the suitability of Azure Spot VMs.

Spot VMs are rejected because they are subject to sudden eviction, which violates the requirement for uninterrupted 72-hour execution.

Using Spot VMs for critical production or long-running stateful workloads leads to high failure rates due to capacity reclaim.

Evaluate the suitability of Azure Functions on a Consumption plan.

Azure Functions are rejected due to the 10-minute maximum execution timeout limit.

Serverless consumption plans are designed for short-lived, event-driven tasks rather than multi-day simulations.

Select the appropriate VM series and purchasing option.

Standard H-series VMs are selected because H-series is optimized for HPC (providing InfiniBand networking) and standard pricing ensures no eviction.

This configuration satisfies both the physical networking requirement and the strict availability constraint.

Key Concept

Selecting Azure VM series and pricing tiers based on performance, network latency, and availability constraints.

Estimated Time:1m 30s

Question 1153Question →

A cloud architect is planning a secure Azure network topology for a multi-tier application environment. The infrastructure consists of:

- A hub virtual network named `vnet-transit-hub-weur` ( $10.240.0.0/16$ ) hosting an Azure Firewall ( $10.240.1.4$ ) in `AzureFirewallSubnet` and an Azure Virtual Network Gateway in `GatewaySubnet`.
- A production application spoke virtual network named `vnet-prod-app-weur` ( $10.241.0.0/16$ ).
- A shared database spoke virtual network named `vnet-shared-db-weur` ( $10.242.0.0/16$ ).
- Virtual network peering connections linking the hub to each spoke virtual network.

The design must satisfy the following requirements:
- All traffic between `vnet-prod-app-weur` and `vnet-shared-db-weur` must pass through the Azure Firewall for inspection.
- VMs in both spokes must maintain access to the on-premises datacenter via the central Virtual Network Gateway.
- Local traffic within each spoke virtual network must remain local and bypass the hub.

Which two configurations should the architect recommend to satisfy these requirements? (Select two.)

Select all that apply

Associate a route table with the subnets in `vnet-prod-app-weur` that contains a route for

10.242.0.0/16

with the next hop set to the Azure Firewall private IP address.

Enable gateway transit on the virtual network peering settings for `vnet-transit-hub-weur`, and configure both spoke virtual networks to use the remote virtual network's gateway.

Associate a route table with the subnets in `vnet-prod-app-weur` that contains a route for

10.241.0.0/16

with the next hop set to the Azure Firewall private IP address.

Associate a route table with the subnets in `vnet-shared-db-weur` that contains a route for

10.242.0.0/16

with the next hop set to the Azure Firewall private IP address.

Show answer & explanation

Answer: Associate a route table with the subnets in `vnet-prod-app-weur` that contains a route for $10.242.0.0/16$ with the next hop set to the Azure Firewall private IP address.; Enable gateway transit on the virtual network peering settings for `vnet-transit-hub-weur`, and configure both spoke virtual networks to use the remote virtual network's gateway.

Answer

The correct configurations are to associate a route table with the subnets in the production spoke containing a route for the database spoke's IP range pointing to the Azure Firewall, and to configure virtual network peering to allow gateway transit on the hub while configuring the spokes to use the remote gateway.

To route traffic between the spokes through the hub firewall, a user-defined route (UDR) must be added to the spoke subnets. The route in the production spoke must target the database spoke address space (

10.242.0.0/16

) and use the Azure Firewall (

10.240.1.4

) as the next hop. To enable spoke traffic to reach the on-premises network, virtual network peering gateway transit must be configured. This requires enabling gateway transit on the hub peering and configuring the spoke peerings to use the remote virtual network's gateway.

Step-by-Step Solution

Determine the required route for spoke-to-spoke traffic.

A route for the destination spoke (

10.242.0.0/16

) pointing to the Azure Firewall (

10.240.1.4

) must be added to the source spoke's subnet.

By default, Azure peerings do not transitively route spoke-to-spoke traffic. User-defined routes are required to redirect destination traffic through the hub firewall.

Ensure local subnet routing is preserved.

Avoid defining routes that match the local virtual network's address space (

10.241.0.0/16

on the production spoke, or

10.242.0.0/16

on the database spoke).

Routing the local prefix to a virtual appliance overrides the default local system route, disrupting intra-VNet and intra-subnet communication.

Configure gateway sharing across peerings.

Select 'Allow gateway transit' on the hub virtual network peering and 'Use the remote virtual network's gateway or Route Server' on the spoke side peerings.

This allows VMs in the spoke virtual networks to leverage the Virtual Network Gateway in the hub for hybrid connectivity.

Key Concept

Configuring User-Defined Routes (UDRs) and Peering Gateway Transit in Azure Hub-and-Spoke Topologies

Estimated Time:2m 0s

Question 1154Question →

An organization is designing a regional web application hosted on Azure Virtual Machines in the West US region. The architecture must satisfy the following requirements:
- Provide URL path-based routing to direct traffic to different backend pools.
- Support SSL/TLS termination at the load balancer.
- Ensure that the backend virtual machines are not accessible from the public internet.
The existing virtual machines are currently configured with Basic SKU Public IP addresses.

Which load balancing configuration should you recommend to meet the requirements?

Remove the Basic SKU Public IP addresses from the virtual machines and deploy Azure Application Gateway.

Associate the virtual machines using their existing Basic SKU Public IP addresses with a Standard SKU Azure Load Balancer.

Deploy Azure Traffic Manager to route incoming client traffic to the virtual machines based on the URL path.

Deploy Azure Front Door and configure it to route traffic directly to the private IP addresses of the virtual machines.

Show answer & explanation

Answer: Remove the Basic SKU Public IP addresses from the virtual machines and deploy Azure Application Gateway.

Answer

Remove the Basic SKU Public IP addresses from the virtual machines and deploy Azure Application Gateway.

The correct option is to remove the Basic SKU Public IP addresses and deploy Azure Application Gateway. Azure Application Gateway is a regional Layer 7 load balancer that supports URL path-based routing and SSL/TLS termination. It interacts with the backend virtual machines using their private IP addresses, which allows the public IP addresses to be removed from the virtual machines, ensuring they are not directly exposed to the public internet.

Step-by-Step Solution

Analyze the application requirements.

The requirements demand Layer 7 capabilities: URL path-based routing and SSL/TLS termination.

These capabilities are only available in application-layer load balancers, not Layer 4 load balancers.

Evaluate the regional and network security constraints.

The virtual machines must not be exposed to the public internet, and they currently use Basic SKU Public IP addresses.

By using a regional Layer 7 load balancer like Azure Application Gateway, the backend pools can be configured using private IP addresses. This allows for the removal of the Basic SKU Public IP addresses from the virtual machines, securing the backend.

Select the correct Azure service.

Azure Application Gateway is selected.

It natively provides SSL termination, URL path-routing, and runs within a virtual network to route traffic to private IP addresses.

Key Concept

Application-layer load balancing using Azure Application Gateway

Question 1155Question →

A company plans to migrate a legacy payroll application currently running on on-premises physical servers to Azure. The application consists of several web and application servers, along with a Microsoft SQL Server database that utilizes SQL Server Agent jobs and cross-database queries. The network connections between the application servers and external systems are undocumented. The company wants to minimize deployment complexity and administrative overhead for the migration and the final hybrid identity solution. Which migration assessment, database tier, and identity synchronization strategy should you recommend?

Perform agent-based dependency analysis using Azure Migrate, select Azure SQL Managed Instance for the database tier, and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Perform agentless dependency analysis using Azure Migrate, select Azure SQL Managed Instance for the database tier, and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Perform agent-based dependency analysis using Azure Migrate, select Azure SQL Database for the database tier, and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Perform agent-based dependency analysis using Azure Migrate, select Azure SQL Managed Instance for the database tier, and implement Active Directory Federation Services (AD FS).

Show answer & explanation

Answer: Perform agent-based dependency analysis using Azure Migrate, select Azure SQL Managed Instance for the database tier, and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Answer

Perform agent-based dependency analysis using Azure Migrate, select Azure SQL Managed Instance for the database tier, and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

The correct strategy involves using agent-based dependency analysis because Azure Migrate only supports agent-based dependency mapping for physical servers (unlike VMware or Hyper-V, which support agentless analysis). Azure SQL Managed Instance is required because the database tier relies on SQL Server Agent jobs and cross-database queries, which are not natively supported in Azure SQL Database. Password Hash Synchronization (PHS) with Microsoft Entra Connect is the simplest hybrid identity solution that minimizes administrative overhead and deployment complexity while meeting standard authentication requirements, unlike Active Directory Federation Services (AD FS), which requires significant on-premises infrastructure.

Step-by-Step Solution

Select the dependency assessment approach for physical servers.

Determine that agent-based dependency analysis is required.

Azure Migrate only supports agent-based dependency mapping for physical servers; agentless mapping is restricted to VMware and Hyper-V environments.

Determine the appropriate Azure relational database target tier based on features.

Select Azure SQL Managed Instance.

The application database relies on SQL Server Agent and cross-database queries, which are supported in Azure SQL Managed Instance but not natively supported in Azure SQL Database.

Identify the hybrid identity integration method that minimizes administrative overhead.

Select Password Hash Synchronization (PHS) with Microsoft Entra Connect.

PHS allows hybrid identity integration with minimal setup and maintenance, whereas Active Directory Federation Services (AD FS) introduces high complexity and is not required for standard integration needs.

Key Concept

Selecting migration assessment methods, database tiers, and hybrid identity architectures based on server types, application feature requirements, and operational overhead.

Question 1156Question →

An enterprise is planning to migrate a critical, steady-state production ERP system to Azure. The system consists of two main components: a stateful database tier that runs continuously and requires guaranteed compute availability, and a stateless web server tier that must scale dynamically to handle variable user traffic. Both tiers must be designed to minimize compute costs over a multi-year period, but the solution must guarantee that no virtual machines are subject to unexpected eviction or disruption. Which two virtual machine options or pricing models should you recommend to meet these requirements?

Select all that apply

Azure Reserved Virtual Machine Instances for the database tier

Virtual Machine Scale Sets with Flexible orchestration for the web tier

Azure Spot Virtual Machines for the database tier

Azure Spot Virtual Machines for the web tier

Show answer & explanation

Answer: Azure Reserved Virtual Machine Instances for the database tier; Virtual Machine Scale Sets with Flexible orchestration for the web tier

Answer

Azure Reserved Virtual Machine Instances for the database tier, and Virtual Machine Scale Sets with Flexible orchestration for the web tier

For the database tier, Azure Reserved Virtual Machine Instances are the correct choice because they provide cost optimization for a 24/7 steady-state workload without any risk of eviction. For the web tier, Virtual Machine Scale Sets with Flexible orchestration are the correct choice because they enable dynamic scaling and high availability across multiple availability zones for stateless workloads.

Step-by-Step Solution

Analyze the database tier requirements

The database is a steady-state workload that runs 24/7 and cannot tolerate eviction. Azure Reserved Instances provide cost savings for predictable, continuous compute needs without eviction risk.

Reserved Instances offer up to 72% cost savings over pay-as-you-go for workloads committed to 1 or 3 years.

Analyze the web tier requirements

The web tier requires dynamic scaling to handle variable user traffic. Virtual Machine Scale Sets allow for automated autoscaling. Flexible orchestration mode provides high availability and VM control.

Virtual Machine Scale Sets allow stateless web tiers to scale out and in based on demand.

Evaluate and eliminate Spot VM options

Spot VMs are eliminated because they can be evicted with a 30-second warning, violating the zero-eviction SLA requirement for both tiers.

Spot VMs are designed for interruptible workloads, not critical production systems.

Key Concept

Selecting Azure compute and pricing options based on workload predictability, scaling requirements, SLA, and cost constraints.

Estimated Time:1m 30s

Question 1157Question →

An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier application. The topology consists of the following components:

* A hub virtual network named `vnet-hub-eus` ( $10.100.0.0/16$ ) that hosts a central firewall Network Virtual Appliance (NVA) at the IP address $10.100.1.4$ .
* A spoke virtual network named `vnet-spoke-app` ( $10.200.0.0/16$ ) that contains two subnets: `snet-web` ( $10.200.1.0/24$ ) for web servers and `snet-db` ( $10.200.2.0/24$ ) for database servers.

The virtual networks are peered to allow direct connectivity. You need to design a routing solution that forces all traffic from the web servers in `snet-web` to the database servers in `snet-db` to transit the firewall NVA in the hub for inspection. However, traffic between web servers within the same `snet-web` subnet must remain local and bypass the NVA.

An administrator proposes creating a route table, adding a route for the address prefix $10.200.0.0/16$ with a next hop type of Virtual appliance and IP address $10.100.1.4$ , and associating it with `snet-web`.

What is the primary issue with this proposed design?

The custom route is ignored because Azure system-defined local routes always take precedence over user-defined routes with matching address spaces.

The route table cannot be associated with the subnet because it contains active Basic SKU Load Balancer resources, which do not support custom routing.

It overrides the local system route for the virtual network, causing intra-subnet traffic within the web subnet to be routed to the NVA.

The traffic is blocked because Azure network security groups do not support transit routing through NVAs unless service tags are configured.

Show answer & explanation

Answer: It overrides the local system route for the virtual network, causing intra-subnet traffic within the web subnet to be routed to the NVA.

Answer

The correct answer is that the proposed route overrides the local system route for the virtual network, causing intra-subnet traffic within the web subnet to be routed to the network virtual appliance (NVA).

The correct answer is correct because User-Defined Routes (UDRs) take precedence over default system-defined routes. By configuring a UDR for the entire VNet prefix (

10.200.0.0/16

), the system route that normally keeps local VNet traffic within the virtual network is overridden. As a result, traffic between hosts on the same subnet is sent to the Network Virtual Appliance (NVA) at

10.100.1.4

, disrupting local communication.

Step-by-Step Solution

Analyze Azure route precedence rules.

Confirm that User-Defined Routes (UDRs) always take precedence over default system routes when the destination prefixes match or are more specific.

This establishes that the custom route table will override the default system routes on the subnet.

Identify the default system route for local traffic.

The spoke virtual network has a system-defined route for

10.200.0.0/16

with the next hop 'Virtual Network' to keep local traffic within the VNet.

This is the baseline route that permits internal communication between systems in different subnets or the same subnet.

Evaluate the impact of the proposed route.

The proposed route targets the broad range

10.200.0.0/16

and points to the NVA (

10.100.1.4

). This directly overrides the 'Virtual Network' system route.

Since the prefixes match, the UDR takes precedence, forcing all VNet-destined traffic to go to the NVA.

Determine how this affects local traffic.

Traffic originating from `snet-web` destined for another IP in the same subnet (e.g.,

10.200.1.10

10.200.1.11

) will match the UDR and be forwarded to the hub NVA, breaking intra-subnet connectivity.

This isolates why the broad address space selection in the UDR is problematic.

Formulate the correct configuration.

Define a more specific UDR targeting only the database subnet (

10.200.2.0/24

) with a next hop pointing to the NVA (

10.100.1.4

By using a more specific prefix for the database subnet, local subnet traffic will continue using the default 'Virtual Network' system route, keeping it local.

Key Concept

Azure route precedence dictates that User-Defined Routes (UDRs) override system-defined routes. Configuring a UDR with an address prefix that encompasses the entire local Virtual Network (VNet) overrides the default local system route, causing all intra-VNet and intra-subnet traffic to be sent to the specified next hop, which breaks local communication.

Question 1158Question →

A collaborative document editing platform has a global user base and is deployed across virtual machines in the East US and West US regions. You are designing an application delivery and load balancing solution for the platform. The solution must meet the following requirements:
- Route users to the region that offers the lowest latency.
- Implement path-based routing within each region, directing requests for `/edit/*` and `/view/*` to separate backend pools.
- Support SSL/TLS termination at the regional entry point.
- Align with availability zone designs and use Standard SKU resources.

Which two of the following Azure resources should you include in the architectural design to meet these requirements?

Select all that apply

Azure Front Door configured with latency-based routing

Azure Application Gateway (Standard v2) in each region

Azure Traffic Manager profile configured with performance routing

Azure Load Balancer (Basic SKU) in each region

Show answer & explanation

Answer: Azure Front Door configured with latency-based routing; Azure Application Gateway (Standard v2) in each region

Answer

Azure Front Door and Azure Application Gateway (Standard v2) in each region

Azure Front Door is selected to provide global latency-based routing for the web application, directing global users to the closest region. Inside each region, Azure Application Gateway (Standard v2) is deployed to handle the Layer 7 requirements, specifically path-based routing (for `/edit/*` and `/view/*`) and SSL/TLS termination, while satisfying the requirement for Standard SKU alignment and availability zones.

Step-by-Step Solution

Select the global load balancing service for HTTP/S traffic.

Azure Front Door is chosen to provide global latency-based routing for web traffic.

Azure Front Door is a global Layer 7 load balancer that directs users to the closest regional endpoint with minimal latency.

Select the regional load balancing service that supports path-based routing and SSL termination.

Azure Application Gateway (Standard v2) is selected for each region.

Azure Application Gateway provides Layer 7 capabilities, enabling routing based on URL paths (`/edit/*` and `/view/*`) and performing SSL/TLS termination at the regional level.

Verify SKU compatibility with availability zones and other resources.

Avoid Basic SKU load balancers and ensure Standard SKU alignment.

Mixing Basic and Standard SKUs in Azure network resources causes deployment validation failures, and Standard SKU is required for zone redundancy.

Key Concept

Combining global latency-based routing with regional path-based application load balancing using Standard SKU resources.

Estimated Time:1m 30s

Question 1159Question →

A company plans to migrate a line-of-business (LOB) application from an on-premises Hyper-V environment to Azure. The application consists of three web servers running on Windows Server virtual machines and a database backend running on SQL Server 2022. The database backend requires SQL Server Agent jobs to schedule nightly maintenance and cross-database queries to pull data from a separate legacy HR database. The on-premises environment uses Active Directory Domain Services (AD DS) for authentication. The hybrid identity solution only requires user authentication without federated authentication. You need to design the migration assessment and target architecture while minimizing administrative overhead, complexity, and the risk of service disruption. Which two actions should you recommend? (Choose two)

Select all that apply

Target Azure SQL Database (single database) for the database backend migration.

Deploy Active Directory Federation Services (AD FS) on-premises and in Azure to federate identity with Microsoft Entra ID.

Proceed with migration planning without performing dependency analysis to minimize the duration of the assessment phase.

Configure Azure Migrate to perform dependency analysis for the on-premises virtual machines.

Target Azure SQL Managed Instance for the database backend migration.

Show answer & explanation

Answer: Configure Azure Migrate to perform dependency analysis for the on-premises virtual machines.; Target Azure SQL Managed Instance for the database backend migration.

Answer

To successfully migrate the workload while meeting all technical requirements and minimizing overhead, you must configure Azure Migrate to perform dependency analysis for the on-premises virtual machines and target Azure SQL Managed Instance for the database backend.

The correct recommendations are to configure Azure Migrate to perform dependency analysis for the on-premises virtual machines and to target Azure SQL Managed Instance for the database backend. Dependency analysis is critical to map out network communication dependencies between servers, ensuring that the migration does not break connections to other on-premises systems like the legacy HR database. Azure SQL Managed Instance is the most appropriate database tier because it supports required legacy SQL Server features, such as SQL Server Agent and cross-database queries, while providing a fully managed service that minimizes administrative overhead.

Step-by-Step Solution

Analyze database requirements.

Identify the need for SQL Server Agent and cross-database queries.

These requirements eliminate Azure SQL Database (single database) from consideration since it does not support these features.

Analyze identity and migration dependency requirements.

Identify the need to map connections to the legacy HR database and establish simple user authentication.

A dependency analysis is required to prevent broken connections, and Active Directory Federation Services (AD FS) should be avoided to prevent unnecessary complexity since federation is not required.

Select the migration tools and target tiers.

Select Azure SQL Managed Instance for the database and Azure Migrate dependency analysis for the virtual machines.

Azure SQL Managed Instance provides the necessary SQL Server compatibility with managed service benefits, and Azure Migrate dependency analysis ensures all service connections are discovered.

Key Concept

Selecting appropriate database migration targets and planning dependency assessments to ensure application compatibility and connectivity during Azure migrations.

Question 1160Question →

A logistics company is designing the compute infrastructure for a new real-time fleet tracking application. The application consists of a stateless API layer that runs continuously 24/7. The API layer requires a 99.99% availability SLA and must be deployed across multiple Availability Zones to ensure resiliency. The workload is highly predictable with a steady-state CPU and memory usage profile. The company wants to minimize compute costs over a three-year period without risking service interruption.

Which compute solution should you recommend to meet these requirements?

Deploy the API layer on Azure Spot Virtual Machines across three Availability Zones.

Deploy the API layer on standard Azure Virtual Machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones.

Deploy the API layer on Azure Virtual Machine Scale Sets in a single Availability Zone using Pay-As-You-Go D-series virtual machines.

Deploy the API layer on Azure Virtual Machine Scale Sets using the Uniform orchestration mode with Spot priority across multiple Availability Zones.

Show answer & explanation

Answer: Deploy the API layer on standard Azure Virtual Machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones.

Answer

Deploy the API layer on standard Azure Virtual Machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones.

Deploying standard virtual machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones is correct. Reserved instances provide significant cost savings (up to 72% compared to pay-as-you-go) for predictable, steady-state workloads with a long-term commitment. Deploying across multiple zones meets the 99.99% availability SLA without the risk of eviction.

Step-by-Step Solution

Analyze the SLA and availability requirements.

The application requires a 99.99% VM availability SLA and must be deployed across multiple Availability Zones to ensure resiliency.

This rules out single-zone deployments which do not meet the 99.99% VM availability SLA criteria.

Analyze the workload profile and tolerance for interruption.

The workload is a continuous, 24/7 steady-state API that cannot tolerate service interruptions.

This rules out Spot VMs and Spot-priority Virtual Machine Scale Sets, as they can be evicted at any time without warning.

Evaluate the cost optimization options for a three-year horizon.

Azure Reserved Virtual Machine Instances with a three-year commitment match the steady-state nature of the workload and maximize savings.

Reserved Instances offer up to 72% savings compared to pay-as-you-go pricing for predictable, long-running virtual machine workloads.

Key Concept

Selecting Azure VM purchasing models and resiliency configurations based on SLA, cost constraints, and workload predictability.

PreviousPage 58 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept