Examkin

All practice questions

617 questions

All types1,198Multiple choice617Multiple select502Matching65Ordering14
Question 1Question →

Lumina Healthcare has an on-premises Active Directory Domain Services (AD DS) forest named internal.luminahealth.org. You are designing a hybrid identity solution to integrate the on-premises AD DS with a new Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to authenticate to cloud services using their on-premises passwords.
- Users must be able to authenticate to cloud services even during a complete on-premises internet connectivity outage.
- Users must be allowed to reset their passwords using Microsoft Entra Self-Service Password Reset (SSPR), and password changes must immediately sync back to on-premises.
- Multi-factor authentication (MFA) must be enforced for all admin accounts, but you must prevent accidental tenant lockout if the primary MFA service experiences an outage.

Which identity design meets all of these requirements?

Show answer & explanation

Answer: Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect. Implement a Conditional Access policy requiring MFA for all administrator roles, and exclude a designated emergency access account from this policy.

Answer

Configure Password Hash Synchronization (PHS) and enable Password Writeback in Microsoft Entra Connect, combined with a Conditional Access policy requiring MFA for administrative roles that excludes an emergency access account.
The correct option addresses all design constraints by utilizing Password Hash Synchronization (PHS) for resilient hybrid identity, enabling Password Writeback to support self-service password reset (SSPR), and excluding a break-glass account from the administrator multi-factor authentication (MFA) policy to prevent tenant lockout.

Step-by-Step Solution

1
Select the hybrid authentication sync method that maintains service availability during on-premises internet outages.
Password Hash Synchronization (PHS) is selected.
PHS validates credentials in the cloud directly, unlike AD FS or PTA which require real-time connectivity to the on-premises infrastructure.
2
Ensure password changes initiated in Microsoft Entra ID are replicated back to the on-premises Active Directory Domain Services.
Password Writeback is enabled.
This enables Microsoft Entra Self-Service Password Reset (SSPR) to write password updates back to the on-premises domain controllers immediately.
3
Apply a Conditional Access policy for administrative accounts with a lockout prevention mechanism.
Exclude a designated emergency access (break-glass) account from the MFA policy.
Failing to exclude an emergency account risks locking all admins out of the tenant if the MFA service is disrupted.

Key Concept

Selecting PHS for high availability hybrid identity authentication, enabling Password Writeback for SSPR, and configuring emergency access exclusions to prevent tenant lockout.
Question 2Question →

A healthcare provider is deploying a new web application on Azure App Service. The compliance team mandates that web server logs must be retained for seven years in a WORM (Write Once, Read Many) state to meet regulatory audits. Additionally, the security operations center (SOC) requires real-time log streaming to an on-premises Security Information and Event Management (SIEM) system. Which log routing design should you recommend to meet these requirements?

Show answer & explanation

Answer: Configure a diagnostic setting on the App Service to stream logs to an Azure Event Hubs namespace for SIEM integration, and to an Azure Storage account with time-based retention policies in immutable storage for archival.

Answer

Configure a diagnostic setting on the App Service to stream logs to an Azure Event Hubs namespace for SIEM integration, and to an Azure Storage account with time-based retention policies in immutable storage for archival.
Routing logs to Azure Event Hubs ensures the real-time streaming requirement for the on-premises SIEM is met, while simultaneously routing to Azure Storage with time-based immutable policies satisfies the seven-year WORM archival requirement in a highly cost-efficient manner.

Step-by-Step Solution

1
Identify the real-time streaming requirement.
Azure Event Hubs is selected as the destination to stream log data to an external, on-premises SIEM in real-time.
Event Hubs acts as the ingestion point for large-scale, real-time log streaming to third-party or on-premises systems.
2
Address the WORM storage and retention requirement.
Azure Blob Storage with immutable storage (time-based retention) is selected for the 7-year archival period.
Immutable storage in Azure Storage accounts provides compliance-grade WORM storage at a highly cost-effective rate compared to active workspace ingestion.
3
Combine the routing mechanisms into a single design.
A diagnostic setting is defined on the App Service that routes logs to both destinations simultaneously.
Azure Monitor diagnostic settings support sending log data to multiple endpoints (Event Hubs, Storage Account, Log Analytics) at the same time.

Key Concept

Azure Monitor diagnostic settings enable routing log data to multiple destinations, including Event Hubs for real-time streaming and Storage Accounts for immutable, cost-effective compliance archiving.
Estimated Time:2m 0s
Question 3Question →

A financial services corporation is establishing a new multi-region environment under a single tenant. The environment is organized under a root-level management group named Enterprise-Core-MG. To comply with regulatory standards, the corporation must enforce two governance policies across all existing and future subscriptions:

1. A specific diagnostic setting must be automatically configured on all subscriptions to forward activity logs to a centralized Log Analytics workspace in the security subscription.
2. A delegated team of operations engineers must be granted the ability to create and manage virtual machines within all subscriptions, without allowing them to modify subscription-level access controls or delete the centralized logging configurations.

Which design configuration should you recommend to meet the requirements while minimizing administrative overhead?

Show answer & explanation

Answer: Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.

Answer

Deploy an Azure Policy definition with the deployIfNotExists effect at the Enterprise-Core-MG scope to configure the diagnostic settings. Create a Microsoft Entra ID security group, add the operations engineers to the group, and assign the Virtual Machine Contributor role to the group at the Enterprise-Core-MG scope.
The correct configuration uses Azure Policy with the deployIfNotExists effect applied at the management group level, which ensures that all child subscriptions automatically configure the diagnostic settings. Additionally, it adheres to the principle of least privilege and simplifies management by assigning the Virtual Machine Contributor role to a Microsoft Entra ID security group at the management group level rather than directly to individual users.

Step-by-Step Solution

1
Define the compliance enforcement mechanism for diagnostic settings.
Identify that Azure Policy with the deployIfNotExists effect at the Enterprise-Core-MG scope ensures automatic remediation and configuration of diagnostic settings on all present and future subscriptions.
This automates compliance without blocking deployment workflows or requiring manual configuration.
2
Group operations engineers to manage identity efficiently.
Create a single Microsoft Entra ID security group containing the operations engineers.
Grouping identities reduces administrative overhead and enables scalable access control instead of managing individual role assignments.
3
Assign the Virtual Machine Contributor role to the security group at the management group scope.
The role assignment inherits down to all subscriptions within the management group, providing the operations team with permissions to manage virtual machines without owner-level privileges.
This satisfies the least privilege requirement and ensures the team cannot modify subscription-level access controls or delete central configuration resources.

Key Concept

Combining management group-scoped Azure Policy remediation with group-based RBAC assignments to achieve automated subscription compliance and delegated least-privilege administration.
Question 4Question →

Vespera Industries has an on-premises Active Directory Domain Services (AD DS) forest containing 3,100 users. The company is planning to implement a hybrid identity solution that integrates the on-premises environment with a single Microsoft Entra ID tenant.

The solution must meet the following requirements:
- Users must be able to sign in to Azure cloud services using their on-premises credentials.
- Cloud authentication must remain functional even if the on-premises domain controllers or network connectivity on-premises become completely unavailable.
- On-premises infrastructure footprint and management overhead must be minimized.

Which hybrid identity authentication method should Vespera Industries implement?

Show answer & explanation

Answer: Password Hash Synchronization (PHS)

Answer

Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) meets all the requirements. It synchronizes a hash of the user's password hash from on-premises AD DS to Microsoft Entra ID, allowing authentication to occur entirely within Microsoft Entra ID. Because the credentials are stored in the cloud, user sign-in remains functional even if the on-premises domain controllers or network connectivity are completely unavailable. PHS requires the least infrastructure footprint, running as part of the core synchronization process without needing additional servers or agents for authentication.

Step-by-Step Solution

1
Analyze the business continuity and availability requirements for cloud authentication.
Identify that the solution must support authentication even if on-premises domain controllers or network connectivity are offline.
This eliminates authentication methods that require real-time communication with the on-premises environment (such as Pass-through Authentication and Active Directory Federation Services).
2
Analyze the infrastructure footprint and management overhead requirements.
Determine that the solution must minimize the deployment of extra components, agents, and virtual machines.
This eliminates deploying AD DS domain controllers in Azure VMs, as well as complex federation infrastructures like Active Directory Federation Services (AD FS).
3
Select the synchronization and authentication method that stores credentials in the cloud and requires the minimum setup.
Select Password Hash Synchronization (PHS) as it validates credentials in Microsoft Entra ID and has the lowest operational overhead.
PHS meets the offline capability requirement because Microsoft Entra ID processes the logins, and it meets the minimal footprint requirement because it uses the standard sync configuration.

Key Concept

Selecting the appropriate hybrid identity authentication method (PHS vs. PTA vs. AD FS) based on business continuity and infrastructure overhead constraints.
Question 5Question →

An enterprise is designing a monitoring and log routing architecture for application workloads deployed across two Azure regions: East US and West US.

The design must meet the following requirements:
- Members of the East US operations team must only view logs for East US resources.
- Members of the West US operations team must only view logs for West US resources.
- A central security team must be able to query logs across both regions.
- Cross-region data egress costs for log ingestion must be minimized.
- All newly deployed resources in both regions must be automatically configured to route their diagnostic logs to the appropriate destination.
- Administrative governance and access management must follow Microsoft best practices.

Which log routing and access management strategy should you recommend?

Show answer & explanation

Answer: Deploy a Log Analytics workspace in East US and another in West US. Associate the regional operations teams with Microsoft Entra groups and assign each group the Reader role on its respective regional workspace. Assign the central security team's Entra group the Reader role on both workspaces. Use Azure Policy with a DeployIfNotExists effect to automatically configure diagnostic settings for new resources to point to their local regional workspace.

Answer

Deploy a Log Analytics workspace in each region, use Microsoft Entra groups to assign workspace-level Reader roles to the respective regional teams and the security team, and apply Azure Policy with a DeployIfNotExists effect to automate diagnostic settings configuration.
The correct strategy involves deploying separate regional workspaces to keep data transfer local, thereby minimizing cross-region egress costs. Administrative isolation is achieved by assigning regional teams workspace-level Reader permissions via Microsoft Entra groups, which aligns with identity governance best practices. The central security team can query logs across both workspaces. Lastly, the DeployIfNotExists policy effect is the correct choice to automate the configuration of diagnostic settings on newly deployed resources.

Step-by-Step Solution

1
Determine the workspace architecture and placement based on cost constraints.
Two regional Log Analytics workspaces (one in East US, one in West US) are required to ensure that logs are ingested within the same region, avoiding cross-region egress charges.
Log ingestion across regions incurs data transfer costs, which violates the requirement to minimize data egress costs.
2
Define the access control and administrative mapping using Microsoft Entra groups.
Regional teams are assigned Reader access to their respective workspaces using Entra groups to enforce regional isolation, while the central security group is assigned Reader access to both workspaces.
Microsoft best practices dictate assigning roles to groups rather than individuals to reduce administrative overhead and ensure scalable identity governance.
3
Select the policy effect that satisfies automatic compliance remediation.
An Azure Policy with the DeployIfNotExists effect is deployed to automatically configure diagnostic settings on newly created resources.
A DeployIfNotExists policy automatically remediates non-compliant resources by creating the diagnostic settings, whereas a Deny policy would reject the deployment outright.

Key Concept

Designing regional monitoring solutions that balance regional log isolation, data egress costs, Entra ID identity governance, and automated configuration using Azure Policy.
Question 6Question →

A retail corporation plans to migrate an on-premises inventory management system to Microsoft Azure. The database tier has the following requirements:
- The system must run a specialized database monitoring agent directly on the database server's operating system, which requires local administrator privileges.
- The environment must support SQL Server Agent to run scheduled maintenance and data synchronization jobs.
- The administration team must minimize the operational overhead of manually managing operating system updates and SQL Server patches.
- The database storage must support high-performance transactions, with the ability to dynamically scale disk performance up to 80,00080,000 IOPS.

Which Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: SQL Server on Azure Virtual Machines

Answer

SQL Server on Azure Virtual Machines
SQL Server on Azure Virtual Machines is correct because it provides full access to the underlying operating system, allowing the installation of custom monitoring agents with local administrator privileges. Automated patching overhead is minimized through the SQL Server IaaS Agent Extension.

Step-by-Step Solution

1
Identify the core operating system and application requirements.
The requirement for a local OS-level monitoring agent with administrative access rules out fully managed platform services.
Managed services like Azure SQL Database and Azure SQL Managed Instance abstract the underlying operating system and do not allow administrative logins or local agent installations.
2
Verify how the administrative patching overhead requirement can be met.
SQL Server on Azure Virtual Machines supports Automated Patching when registered with the SQL Server IaaS Agent Extension.
This minimizes the operational overhead of manual patching while still providing full OS-level control.
3
Evaluate storage performance capabilities for the chosen solution.
SQL Server on Azure VMs can be configured with Premium SSD v2 or Ultra Disk to support scaling up to 80,00080,000 IOPS.
This satisfies the high-performance transaction scaling requirements.

Key Concept

Selecting SQL Server on Azure VMs when local OS access or third-party agent installation is required, combined with IaaS extension for automated management.
Question 7Question →

A retail company plans to migrate its inventory reconciliation service to Azure Virtual Machines. The service must achieve a cumulative virtual machine uptime SLA of 99.99% and must be resilient against the failure of an entire datacenter.

Which virtual machine deployment configuration should you design to satisfy these requirements?

Show answer & explanation

Answer: Deploy the virtual machines across multiple Availability Zones in the same Azure region.

Answer

Deploy the virtual machines across multiple Availability Zones in the same Azure region.
Deploying virtual machines across multiple Availability Zones in the same Azure region guarantees a 99.99% uptime SLA for at least one instance. This architecture ensures that if a single datacenter or zone experiences an outage, instances in the remaining zones continue to operate, meeting both the high availability SLA and the zone-resilience requirement.

Step-by-Step Solution

1
Analyze the service's high availability SLA and resilience requirements.
The target SLA is 99.99% uptime for compute instances, and the architecture must survive a datacenter-level outage.
This establishes the minimum infrastructure boundaries required to design the compute deployment.
2
Evaluate the SLA guarantees of different Azure compute deployment models.
Single-zone Availability Sets provide 99.95% SLA. Multi-zone deployments (deploying VMs across two or more Availability Zones in a region) guarantee 99.99% SLA.
Matching the SLA requirements with Azure SLA documentation determines which architectural options are viable.
3
Assess the susceptibility of each configuration to datacenter failure.
Multi-zone placement distributes VMs across physically separate datacenters with independent power, cooling, and networking. Single-zone placements (including Availability Sets or single-zone Scale Sets) concentrate resources within a single zone.
This ensures the solution provides the necessary resilience to survive a localized datacenter disaster.

Key Concept

Azure Virtual Machine High Availability SLAs and Zonal Redundancy
Estimated Time:1m 30s
Question 8Question →

An enterprise is designing a high-availability infrastructure for a custom TCP-based application running on Azure Virtual Machines (VMs) in the West US 3 region. The VMs are currently configured with Basic SKU Public IP addresses. To meet SLA requirements, the load balancing solution must support Availability Zones. You plan to implement an Azure Load Balancer to distribute the incoming TCP traffic. Which of the following actions is required to design a valid load balancing configuration that supports Availability Zones?

Show answer & explanation

Answer: Deploy a Standard Load Balancer and upgrade the Public IP addresses of the virtual machines to Standard SKU.

Answer

Deploy a Standard Load Balancer and upgrade the Public IP addresses of the virtual machines to Standard SKU.
Deploying a Standard Load Balancer and upgrading the virtual machines' Public IP addresses to Standard SKU is the correct design. The Standard Load Balancer is required to utilize Availability Zones for high availability. In addition, Azure requires all network resources attached to a Standard Load Balancer backend pool to be of the Standard SKU, meaning the existing Basic SKU Public IPs on the VMs must be upgraded to Standard SKU to pass validation.

Step-by-Step Solution

1
Analyze the load balancing protocol and high-availability requirements.
The application requires Layer 4 TCP load balancing with support for Availability Zones.
This rules out HTTP-only load balancers like Application Gateway and restricts the selection to Azure Load Balancer SKUs that support Availability Zones.
2
Determine the appropriate Azure Load Balancer SKU based on zone support.
Azure Standard Load Balancer must be used.
Basic Load Balancer does not support Availability Zones, meaning only the Standard SKU can meet the zone-redundancy requirements.
3
Check compatibility between the backend virtual machines and the selected Load Balancer SKU.
The Basic SKU Public IPs on the virtual machines must be upgraded to Standard SKU.
Standard Load Balancer requires all backend resources to use Standard SKU IP configurations. Mixing Basic and Standard SKUs in the backend pool of a Standard Load Balancer causes validation failures.

Key Concept

SKU alignment and backend resource compatibility constraints in Azure Load Balancer designs
Question 9Question →

A software-as-a-service (SaaS) provider hosts multi-tenant workloads across isolated Azure resource groups within a single subscription. A team of five support engineers needs administrative access to manage database resources only within a specific client's resource group. You must design an access control solution that aligns with the principle of least privilege and Microsoft security best practices.

Which of the following approaches should you recommend to assign these permissions?

Show answer & explanation

Answer: Create a Microsoft Entra ID security group, add the support engineers to this group, and assign the SQL DB Contributor role to the group at the resource group scope.

Answer

Create a Microsoft Entra ID security group, add the support engineers to this group, and assign the SQL DB Contributor role to the group at the resource group scope.
Assigning the SQL DB Contributor role to a Microsoft Entra ID security group at the resource group scope enforces the principle of least privilege and follows scalable governance best practices. This ensures that permissions are scoped only to the specific client's resources and can be managed easily through group membership.

Step-by-Step Solution

1
Identify the resource scope and role required for the task.
The scope is the specific client's resource group, and the role is SQL DB Contributor.
Ensures the principle of least privilege is applied by restricting administrative access only to the database resources within the target resource group.
2
Determine the administrative identity structure.
A Microsoft Entra ID security group should contain the five support engineers.
Assigning roles to groups rather than individual users ensures scalability and reduces administrative overhead when engineers join or leave the team.

Key Concept

Assigning Azure RBAC roles to Microsoft Entra groups at the resource group scope for scalable governance and least privilege access control.
Question 10Question →

You are designing an Azure Blob Storage solution for storing virtual machine backups. The solution must meet the following requirements:
- Ensure the backups remain available if a single datacenter in the primary region fails.
- Ensure backups can be retrieved within seconds if a restore is initiated.
- Minimize storage costs.

Which storage configuration should you recommend?

Show answer & explanation

Answer: Zone-redundant storage (ZRS) in the Cool access tier

Answer

Zone-redundant storage (ZRS) in the Cool access tier
Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones in the primary region, meeting the requirement to survive a single datacenter (zone) failure. The Cool access tier is cost-effective for storage that is not accessed frequently but requires immediate retrieval times, which matches the backup restoration requirements.

Step-by-Step Solution

1
Identify the resiliency requirement.
The solution must survive a single datacenter failure in the primary region.
Locally-redundant storage (LRS) is insufficient because it only replicates within a single datacenter. Zone-redundant storage (ZRS) or geo-redundant options are required.
2
Analyze retrieval time requirements.
The backups must be retrieved within seconds (sub-second retrieval).
This rules out the Archive access tier, which requires hours for data rehydration. The Hot or Cool tiers are appropriate.
3
Compare cost and redundancy options.
Zone-redundant storage (ZRS) in the Cool tier is selected.
ZRS meets the datacenter resilience requirement at a lower cost than geo-redundant options like RA-GRS, and the Cool tier provides immediate retrieval at a lower storage cost than the Hot tier.

Key Concept

Azure Storage Redundancy and Access Tiers
Question 11Question →

A company is developing a fleet management application. The application will store real-time telemetry from 50,000 delivery vehicles. The workload has a read/write ratio of 80% writes and 20% reads. The data must be distributed across three Azure regions to support global users, and the solution must avoid partition throttling while maintaining high availability. Which configuration should you recommend for the Azure Cosmos DB container?

Show answer & explanation

Answer: Use vehicleId as the partition key and enable multi-region replication.

Answer

Use vehicleId as the partition key and enable multi-region replication.
The correct option is to use vehicleId as the partition key and enable multi-region replication. vehicleId is a high-cardinality key that distributes writes evenly across logical partitions, while multi-region replication ensures low latency and high availability across the three target regions.

Step-by-Step Solution

1
Evaluate the partition key requirements based on the high write volume (80% writes).
Identify that a high-cardinality key is required to distribute writes evenly and avoid hot partitions.
Choosing a low-cardinality key like status or date would concentrate writes into a few partitions, leading to throttling.
2
Evaluate the replication and redundancy requirements for a global application in three regions.
Identify that multi-region replication is required to serve users globally.
Locally redundant storage (LRS) keeps data within a single datacenter facility and cannot support multi-region distribution.

Key Concept

Selecting high-cardinality partition keys and configuring appropriate global distribution in Azure Cosmos DB to prevent throttling and ensure high availability.
Question 12Question →

A company named Aetheris Biotech is designing an identity and access management solution for a new Microsoft Entra ID tenant that will integrate with their on-premises Active Directory Domain Services (AD DS) domain. The design must satisfy the following requirements:

- Users must sign in using their on-premises credentials.
- Authentication must succeed even if the on-premises data centers experience a complete power outage.
- Privileged administrators must only activate their roles for a maximum of 4 hours when performing tasks, avoiding persistent active assignments.
- A Conditional Access policy requiring Multi-Factor Authentication (MFA) must apply to all administrators, but must prevent tenant lockout if the MFA service is unavailable.

Which solution should you recommend?

Show answer & explanation

Answer: Configure Password Hash Synchronization (PHS) as the hybrid authentication method. Use Microsoft Entra Privileged Identity Management (PIM) to configure administrative role assignments as eligible. Create a Conditional Access policy requiring MFA for all administrators, and exclude an emergency access account from this policy.

Answer

Configure Password Hash Synchronization (PHS) as the hybrid authentication method, configure administrative role assignments as eligible using Microsoft Entra Privileged Identity Management (PIM), and create a Conditional Access policy requiring MFA for all administrators while excluding an emergency access account.
The correct solution uses Password Hash Synchronization (PHS) because it copies a hash of the user's password to the cloud, allowing authentication to proceed even when the on-premises infrastructure is offline. By configuring roles as eligible in Microsoft Entra Privileged Identity Management (PIM), administrators must request and activate their roles on-demand (just-in-time), preventing persistent access. Finally, excluding an emergency access account from the MFA Conditional Access policy is a critical best practice that ensures tenant recovery and administration are possible if the MFA service is unavailable.

Step-by-Step Solution

1
Evaluate hybrid authentication options for offline resilience.
Identify Password Hash Synchronization (PHS) as the authentication method that allows authentication to continue in the cloud when the on-premises datacenter is completely offline.
Both Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) depend on active communication with on-premises servers or agents to process sign-ins.
2
Evaluate administrative role assignment strategy for least privilege.
Determine that administrative roles must be configured as eligible assignments in Privileged Identity Management (PIM).
Eligible assignments require administrators to explicitly activate their roles just-in-time, preventing persistent access, whereas active assignments grant immediate, continuous access.
3
Design the Conditional Access policy to prevent administrator lockout.
Exclude at least one emergency access account (break-glass account) from the Conditional Access policy requiring MFA.
Excluding an emergency access account ensures that administrators can still log in and manage the tenant if there is a wide-scale MFA service outage.

Key Concept

Designing resilient hybrid authentication and access governance using Password Hash Synchronization, PIM eligible assignments, and Conditional Access exclusions.
Estimated Time:2m 0s
Question 13Question →

An organization is migrating a high-performance Linux-based application to Azure Virtual Machines. The application requires a shared file system that supports POSIX-compliant file locks and the NFS protocol. The design requires that the storage solution must survive a single zone outage within an Azure region while maintaining high performance. Which storage solution should you recommend?

Show answer & explanation

Answer: Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol.

Answer

Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol.
Premium Azure Files configured with Zone-Redundant Storage (ZRS) using the NFS protocol is correct. Premium Azure Files natively supports NFS 4.1, which provides full POSIX-compliant locking. ZRS replicates data across three availability zones in the region, ensuring the storage survives a zone outage.

Step-by-Step Solution

1
Identify the protocol and locking requirements.
The application requires NFS and POSIX-compliant file locks. Premium Azure Files supports NFS 4.1, which meets this requirement.
Standard Azure Files does not support NFS, which eliminates options using that tier.
2
Determine the redundancy and performance requirements.
The solution must survive a zone outage (requiring Zone-Redundant Storage - ZRS) and maintain high performance (Premium tier).
This rules out options utilizing Locally Redundant Storage (LRS).
3
Evaluate the viability of lifecycle tiering.
Workloads with active file system access cannot use the Archive tier because the retrieval latency is too high.
This eliminates designs proposing Blob Storage with Archive tier lifecycle policies.

Key Concept

Selecting Azure Files Premium tier with ZRS for NFS and zone redundancy.
Question 14Question →

Aetherius Aerospace has an on-premises Active Directory Domain Services (AD DS) forest integrated with a primary Microsoft Entra ID tenant. The company recently partnered with Quantum Labs, which operates its own separate Microsoft Entra ID tenant. You are designing a hybrid and multi-tenant identity solution to meet the following requirements:

- Aetherius Aerospace users must be able to authenticate to cloud services using their on-premises passwords, even if the on-premises datacenters or network links become completely unavailable.
- Aetherius Aerospace users must be able to reset their passwords using a self-service portal in the cloud, and the new passwords must immediately synchronize back to the on-premises AD DS.
- Quantum Labs users must be able to access shared applications in the Aetherius Aerospace tenant using their existing home credentials without creating duplicate accounts.
- To prevent tenant lockout during an identity provider outage, designated emergency access administrator accounts must be able to log in without being blocked by multi-factor authentication (MFA) requirements.

Which identity integration and access control design should you recommend?

Show answer & explanation

Answer: Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users. Configure Microsoft Entra B2B collaboration to invite Quantum Labs users as guests. Apply a Conditional Access policy requiring multi-factor authentication (MFA) for administrative and external access, with an explicit exclusion for emergency access accounts.

Answer

Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Password Writeback for Aetherius Aerospace users, invite Quantum Labs users as guests via Entra B2B collaboration, and apply a Conditional Access policy requiring MFA for administrative and external access with an explicit exclusion for emergency access accounts.
The correct design uses Password Hash Synchronization (PHS) to ensure users can authenticate in the cloud during on-premises outages, and Password Writeback to support self-service password changes. It uses Microsoft Entra B2B to allow Quantum Labs users to authenticate with their home credentials, and it excludes emergency access accounts from MFA to prevent complete tenant lockout during an identity provider outage.

Step-by-Step Solution

1
Determine the synchronization and authentication mechanism for the primary tenant.
Select Password Hash Synchronization (PHS) with Password Writeback.
PHS allows authentication to occur entirely in the cloud, satisfying the business continuity requirement if the on-premises network or domain controllers are offline. Password Writeback is required to support cloud-initiated Self-Service Password Reset (SSPR) writing back to the on-premises directory.
2
Establish the collaboration model for multi-tenant access.
Configure Microsoft Entra B2B collaboration to invite the external tenant's users as guests.
This allows Quantum Labs users to authenticate using their existing home tenant credentials, eliminating the need to manage duplicate accounts or synchronize their passwords.
3
Configure the security policy and emergency access exclusions.
Deploy a Conditional Access policy requiring MFA for administrative and guest access, and add the emergency access accounts to the exclusion list.
Excluding emergency access (break-glass) accounts from the MFA policy ensures that administrators can access the tenant even during a global or regional MFA service outage.

Key Concept

Designing a secure, resilient hybrid and multi-tenant identity solution using Microsoft Entra Connect PHS, B2B collaboration, and Conditional Access with emergency exclusions.
Estimated Time:2m 0s
Question 15Question →

A global financial services firm operates a single-tenant Azure environment structured under a root management group named FinanceRoot. You are designing a delegated administration and governance strategy for a team of external security auditors. The auditors must be able to view policy compliance states and read the configurations of all Key Vaults and Storage Accounts across all current and future subscriptions. The design must adhere to the principle of least privilege, minimize administrative overhead, and ensure that the auditors only have access temporarily when actively performing an audit.

Which strategy should you recommend?

Show answer & explanation

Answer: Create a Microsoft Entra security group. Assign the security group to a custom Azure RBAC role at the FinanceRoot management group scope, defining only the necessary read actions. Configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group.

Answer

The correct strategy is to create a Microsoft Entra security group, assign it to a custom Azure RBAC role at the root management group scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the group.
The correct strategy combines management group scope inheritance, custom RBAC roles for least privilege, security groups for scalable identity administration, and PIM for Groups to enforce JIT access. Assigning the custom role at the FinanceRoot management group ensures automatic inheritance to all child subscriptions. Using a security group avoids direct user assignments, and configuring the auditors as eligible group members in PIM ensures that their access is temporary and must be explicitly activated.

Step-by-Step Solution

1
Define the scope and inheritance requirements for the auditing permissions.
Determine that assigning the custom role at the root management group (FinanceRoot) scope ensures automatic inheritance to all child subscriptions without administrative overhead.
Management groups provide a hierarchical structure that allows RBAC roles to inherit downward to all current and future child subscriptions.
2
Apply the principle of least privilege and administrative scaling for role assignment.
Create a custom Azure RBAC role with specific read-only actions for Key Vaults and Storage Accounts, and assign it to a Microsoft Entra security group rather than individual users.
Assigning roles to groups instead of individual users simplifies administration and ensures scalability.
3
Configure just-in-time (JIT) access to enforce temporary auditing sessions.
Implement Microsoft Entra Privileged Identity Management (PIM) for Groups to make the auditors eligible members of the security group, allowing them to activate membership only during audit windows.
PIM for Groups ensures that administrative permissions are not permanently active, mitigating security risks associated with standing access.

Key Concept

Azure RBAC, Management Group Inheritance, and Microsoft Entra PIM Integration
Question 16Question →

An enterprise stores large volumes of raw sensor data in Parquet format within an Azure Data Lake Storage Gen2 container. Members of the data engineering team need to run occasional, exploratory SQL queries to analyze the schema and contents of new files. They do not want to load the data into a database or keep compute clusters running when no queries are active.

Which Azure Synapse Analytics component is the most appropriate option to satisfy these requirements?

Show answer & explanation

Answer: A serverless SQL pool

Answer

A serverless SQL pool
The correct option is a serverless SQL pool because it allows data engineers to query data in the data lake directly without loading it or provisioning a cluster. It charges per query based on data processed, aligning with the requirement to avoid idle compute costs.

Step-by-Step Solution

1
Analyze the requirements
Occasional, exploratory SQL queries directly on Parquet files in Azure Data Lake Storage Gen2 without provisioning persistent compute clusters.
This establishes that we need an on-demand query engine that charges based on usage rather than continuous provisioning.
2
Evaluate the capabilities of serverless SQL pools vs dedicated SQL pools in Azure Synapse Analytics
Serverless SQL pools run queries on-demand and scale compute automatically, charging only for data processed. Dedicated SQL pools require running clusters and data ingestion.
This helps identify the Synapse component that satisfies the requirement to minimize idle compute cost and query files directly.

Key Concept

Azure Synapse SQL Serverless vs Dedicated Pools
Question 17Question →

A healthcare organization is designing a cloud-based clinical trial platform. Patient health records are stored in an Azure Blob Storage container named `trials`. A third-party auditing firm requires read-only access to this container for a period of 120120 days. The security architecture must ensure that the access can be immediately revoked at any time without rotating the storage account access keys or impacting other applications. Additionally, all access requests must originate from the auditing firm's public IP range of 198.51.100.0/24198.51.100.0/24.

Which access control strategy should you recommend to meet these requirements?

Show answer & explanation

Answer: Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.

Answer

Create a stored access policy on the container, and then generate a service Shared Access Signature (SAS) token that references the policy and specifies the allowed IP address range.
The correct option recommends creating a stored access policy on the container and generating a service SAS token referencing it. A stored access policy provides a way to manage SAS tokens on the server side, allowing revocation by simply deleting or modifying the policy without rotating the storage account keys. It also supports specifying IP address constraints directly in the SAS token parameters.

Step-by-Step Solution

1
Analyze the access scope and revocation requirements.
Identify that the access is limited to a single container for a specific duration, and must be immediately revokable without rotating the storage account keys.
This determines that an ad-hoc SAS token is unsuitable, and a mechanism linked to a stored access policy is required.
2
Compare SAS implementation options.
Confirm that a service SAS referencing a stored access policy allows revocation on the server side by deleting or updating the policy.
This meets the key requirement of revocation without rotating the primary or secondary storage account keys.
3
Apply additional network security controls to the SAS parameter definition.
Verify that the service SAS token can restrict access to the specific external IP address range.
This satisfies the requirement that all requests must originate from the auditing firm's public IP range.

Key Concept

Stored Access Policies and Shared Access Signatures
Question 18Question →

An organization is designing a relational data storage solution for a new patient scheduling portal. The database tier must support the following requirements:

* Run on a single database using a serverless compute model that automatically scales compute resources based on workload demand.
* Automatically pause the database during periods of inactivity to minimize costs.
* Ensure that database backups are resilient against a primary datacenter outage.

Which deployment option should you recommend?

Show answer & explanation

Answer: Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy

Answer

Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy
The correct option is the one specifying Azure SQL Database serverless with Zone-Redundant Storage (ZRS) backup redundancy. Azure SQL Database serverless automatically scales compute for single databases and includes an auto-pause feature to optimize costs during inactive periods. Selecting ZRS replication for database backups ensures that the data is replicated across different availability zones, meeting the requirement to remain resilient against a primary datacenter outage.

Step-by-Step Solution

1
Analyze the database operational model requirements.
The solution requires a single database that supports auto-scaling and auto-pausing during periods of inactivity. This points directly to the serverless compute tier of Azure SQL Database, as Azure SQL Managed Instance and SQL Server on Azure VMs do not support auto-pausing.
To eliminate relational database deployment models that do not meet the primary cost and scalability requirements.
2
Evaluate backup redundancy options for disaster resilience.
The backups must survive a primary datacenter outage. Locally Redundant Storage (LRS) is insufficient because it replicates data within a single datacenter. Zone-Redundant Storage (ZRS) replicates data across three Azure availability zones within the region, providing resilience against datacenter failures.
To select the storage redundancy type that matches the organization's disaster recovery guidelines.
3
Cross-reference disk requirements and administrative limits.
SQL Server on Azure VMs is ruled out due to high management overhead, and using Standard HDD for transaction logs would cause severe performance bottlenecks.
To ensure no other options satisfy the constraints.

Key Concept

Selecting appropriate Azure SQL service tiers and storage redundancy configurations based on workload patterns and disaster recovery requirements.
Question 19Question →

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-eus-hub` (10.100.0.0/1610.100.0.0/16), contains an Azure Route Server in the `RouteServerSubnet` (10.100.1.0/2410.100.1.0/24) and a Network Virtual Appliance (NVA) at IP address 10.100.2.410.100.2.4 in the subnet `snet-eus-nva` (10.100.2.0/2410.100.2.0/24). An ExpressRoute Gateway is deployed in the `GatewaySubnet` (10.100.0.0/2410.100.0.0/24) and connects to the corporate on-premises network (172.16.0.0/12172.16.0.0/12). The spoke virtual network, `vnet-eus-prod` (10.101.0.0/1610.101.0.0/16), contains a web tier subnet, `snet-prod-web` (10.101.10.0/2410.101.10.0/24), and a database tier subnet, `snet-prod-db` (10.101.20.0/2410.101.20.0/24). Virtual network peering is configured between `vnet-eus-hub` and `vnet-eus-prod` with "Allow gateway transit" enabled on the hub and "Use remote virtual network gateways or route server" enabled on the spoke. The Route Server is peered with the NVA. The NVA advertises a default route (0.0.0.0/00.0.0.0/0) via BGP to the Route Server, while the ExpressRoute Gateway propagates the on-premises route (172.16.0.0/12172.16.0.0/12) via BGP. You must design a routing solution for the web tier subnet, `snet-prod-web`, that satisfies the following requirements:

- All internet-bound traffic must route through the NVA (10.100.2.410.100.2.4) for security inspection.
- All traffic to the on-premises network (172.16.0.0/12172.16.0.0/12) must bypass the NVA and route directly to the ExpressRoute Gateway.
- All traffic to the database tier subnet (`snet-prod-db`) must remain local and bypass the NVA.
- All traffic to the hub management subnet, `snet-hub-mgmt` (10.100.3.0/2410.100.3.0/24), must bypass the NVA and route directly.
- All traffic to the private endpoints subnet in the hub, `snet-hub-pe` (10.100.50.0/2410.100.50.0/24), must route through the NVA.

Which route table configuration should you apply to `snet-prod-web` to meet these requirements with the least administrative effort?

Show answer & explanation

Answer: Create a route table with a single User Defined Route (UDR) for 10.100.50.0/2410.100.50.0/24 with the next hop set to Virtual Appliance and IP address 10.100.2.410.100.2.4, and associate it with the subnet.

Answer

Create a route table with a single User Defined Route (UDR) for 10.100.50.0/2410.100.50.0/24 with the next hop set to Virtual Appliance and IP address 10.100.2.410.100.2.4, and associate it with the subnet.
The correct configuration is to create a route table with a single User Defined Route (UDR) for the private endpoints subnet (10.100.50.0/2410.100.50.0/24) pointing to the NVA at 10.100.2.410.100.2.4. Because the virtual network peering has gateway transit enabled on the hub and remote gateway usage enabled on the spoke, Azure Route Server dynamically propagates BGP routes to the spoke's subnets. As a result, the default route (0.0.0.0/00.0.0.0/0) from the NVA and the on-premises route (172.16.0.0/12172.16.0.0/12) from the ExpressRoute Gateway are automatically populated in the routing table of the web tier subnet. Spoke-to-spoke traffic is handled by the local virtual network system route (10.101.0.0/1610.101.0.0/16), and spoke-to-hub management traffic is handled by the peering system route (10.100.0.0/1610.100.0.0/16). Therefore, only the private endpoint subnet (10.100.50.0/2410.100.50.0/24) requires a UDR to override the peering system route via Longest Prefix Match (LPM).

Step-by-Step Solution

1
Analyze the dynamic route propagation configuration.
Since Azure Route Server is peered with the NVA and the ExpressRoute Gateway, and the VNet peering has gateway transit enabled, the spoke subnet automatically learns the default route (0.0.0.0/00.0.0.0/0) pointing to the NVA and the on-premises route (172.16.0.0/12172.16.0.0/12) pointing to the Gateway.
This eliminates the need to manually configure UDRs for internet and corporate on-premises traffic, satisfying the first two requirements.
2
Evaluate the system routing for local and peering traffic.
Traffic within the spoke (10.101.0.0/1610.101.0.0/16) uses the local system route. Traffic to the hub management subnet (10.100.3.0/2410.100.3.0/24) matches the VNet Peering system route (10.100.0.0/1610.100.0.0/16). Both routes bypass the NVA.
System routes handle these paths directly, satisfying the third and fourth requirements without manual intervention.
3
Configure routing for the private endpoints subnet to be inspected by the NVA.
Add a UDR for 10.100.50.0/2410.100.50.0/24 with next hop Virtual Appliance 10.100.2.410.100.2.4. The next hop IP 10.100.2.410.100.2.4 is resolved using the system's VNet Peering route (10.100.0.0/1610.100.0.0/16) because it is more specific than the UDR itself.
This overrides the default peering system route for the private endpoints subnet due to Longest Prefix Match (LPM), while avoiding a recursive routing loop for the NVA's own IP.

Key Concept

Azure Route Server route propagation and User Defined Route (UDR) resolution priority
Estimated Time:3m 0s
Question 20Question →

An enterprise is designing a hub-and-spoke network topology in Azure to host a multi-tier application. The hub virtual network, `vnet-eus-hub` (address space: 10.100.0.0/1610.100.0.0/16), contains an Azure Firewall deployed at the internal IP address 10.100.1.410.100.1.4. A peered spoke virtual network, `vnet-eus-prod` (address space: 10.101.0.0/1610.101.0.0/16), contains two subnets: `snet-web` (10.101.10.0/2410.101.10.0/24) and `snet-db` (10.101.20.0/2410.101.20.0/24).

The security team requires that:
1. All outbound internet traffic from `snet-web` must be inspected by the Azure Firewall.
2. All traffic between `snet-web` and `snet-db` must be inspected by the Azure Firewall.
3. Virtual machines within `snet-web` must be able to communicate directly with each other without traversing the firewall.

A network engineer creates a route table named `rt-web-routes`, defines the following user-defined routes (UDRs), and associates the route table with `snet-web`:
- Route 1: Address prefix 0.0.0.0/00.0.0.0/0 with a next hop of Virtual Appliance (10.100.1.410.100.1.4)
- Route 2: Address prefix 10.101.0.0/1610.101.0.0/16 with a next hop of Virtual Appliance (10.100.1.410.100.1.4)

During testing, the engineer observes that virtual machines within `snet-web` are unable to communicate with each other.

Which configuration change should the engineer implement in the route table to restore intra-subnet connectivity within `snet-web` while maintaining all security requirements?

Show answer & explanation

Answer: Replace Route 2 with a new route for address prefix 10.101.20.0/2410.101.20.0/24 and a next hop of Virtual Appliance (10.100.1.410.100.1.4).

Answer

Replace the broad virtual network route with a specific route for the database subnet address prefix (10.101.20.0/2410.101.20.0/24) pointing to the firewall as the next hop.
Replacing the broad 10.101.0.0/1610.101.0.0/16 route with a specific route for the database subnet (10.101.20.0/2410.101.20.0/24) targeting the firewall (10.100.1.410.100.1.4) correctly routes database traffic to the firewall. Because there is no longer a UDR overriding the local 10.101.10.0/2410.101.10.0/24 range, traffic within the web subnet falls back to the system-defined local route (10.101.0.0/1610.101.0.0/16 -> Virtual Network). Since the system route is a longer prefix match than the default route (0.0.0.0/00.0.0.0/0), intra-subnet traffic bypasses the firewall and remains local.

Step-by-Step Solution

1
Analyze the routing requirements and the current User-Defined Routes (UDRs) associated with the web subnet.
The current UDR (10.101.0.0/1610.101.0.0/16 with next hop 10.100.1.410.100.1.4) is overriding the default system route for the entire virtual network, including the local subnet (10.101.10.0/2410.101.10.0/24).
Because UDRs override system routes of the same prefix, all local traffic within the web subnet is being forwarded to the firewall, which breaks direct subnet communication.
2
Identify how to isolate the database subnet traffic from the local subnet traffic.
Define a more specific route targeting only the database subnet (10.101.20.0/2410.101.20.0/24) with the next hop set to the firewall.
This satisfies the security requirement to inspect all database-bound traffic while removing the override on the local web subnet's IP range.
3
Verify how the remaining traffic types will be routed.
Intra-subnet web traffic (10.101.10.0/2410.101.10.0/24) will match the system route (10.101.0.0/1610.101.0.0/16 -> Virtual Network) since it is more specific than the default route (0.0.0.0/00.0.0.0/0) and there is no overriding UDR. Outbound internet traffic will match the default route (0.0.0.0/00.0.0.0/0) and go to the firewall.
This meets all requirements: outbound traffic goes to the firewall, web-to-database traffic goes to the firewall, and intra-subnet web traffic remains local.

Key Concept

Azure User-Defined Routes (UDRs) override system-defined routes of the same prefix. Broader UDRs covering the entire VNet range will redirect intra-subnet traffic, which can break local communication. To prevent this, UDRs should target specific remote subnets rather than the entire VNet prefix, allowing local traffic to fall back to the system-defined local route.
Page 1 / 31Next
All practice questions — Microsoft Azure Solutions Architect (AZ-305) | Examkin