Design Infrastructure Solutions

An energy exploration company is designing the Azure compute virtualization infrastructure for a seismic modeling platform. The platform consists of two primary workloads:

* Database Engine: A stateful, steady-state data store containing sensitive telemetry data. It must run on physical hardware isolated at the host level to meet compliance requirements. It requires a high memory-to-vCPU ratio and must maintain an uptime SLA of 99.99%.
* Simulation Pipeline: A massive batch-oriented parallel simulation runner. The pipeline is stateless, highly fault-tolerant, can resume from checkpoints, and must run at the lowest possible cost.

Which two compute virtualization configurations should you recommend to meet these requirements? (Select two.)

A healthtech platform is designing an Azure architecture to ingest and analyze genomic sequencing datasets. The solution must support the following workloads:

* Workload A: An API endpoint that receives webhook notifications from external partners. The workload must scale dynamically from zero to handle high bursts of traffic, support custom domain names, and connect securely to an Azure SQL Database using virtual network integration.

* Workload B: A CPU-intensive file processing application packaged as a container image. Each processing run takes between 20 to 45 minutes depending on the file size. The compute resource must scale to zero when no files are available for processing, and it must minimize administrative overhead.

Which two Azure hosting services should you include in the design to meet these requirements?

A smart utilities company is designing a production telemetry processing system on Azure. The system will ingest continuous data streams from regional water meters and place them in an Azure Service Bus queue. A containerized backend application will retrieve the messages and perform complex data analysis.

The system must meet the following requirements:
* Scale container instances dynamically based on the queue length using Kubernetes Event-driven Autoscaling (KEDA).
* Support execution times of up to 25 minutes per data analysis task.
* Maintain continuous availability for this critical workload without risk of unexpected eviction.
* Minimize administrative and operational infrastructure overhead.

Which compute solution should you recommend?

A healthcare provider is designing the Azure compute virtualization infrastructure for a clinical trial analysis application that processes sensitive patient data. The solution must satisfy the following requirements:

* Confidentiality: The patient data must be encrypted in memory during processing to prevent access by hypervisor administrators or other tenants.
* Resilience: The application virtual machines must be distributed across multiple physical hardware racks (fault domains) within an Azure region to guarantee high availability without allocating dedicated physical servers.
* Availability: The compute tier must support a $99.95\%$ availability SLA.
* Storage: The application requires high-performance disk storage supporting at least $5,000\text{ IOPS}$ per virtual machine instance for transaction logging.
* Licensing Costs: The solution must leverage existing Windows Server licenses to minimize operational expenses.

Which of the following compute virtualization designs should you recommend?

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The transit hub virtual network, `vnet-hub-transit` ($172.16.0.0/16$), contains a firewall subnet, `AzureFirewallSubnet` ($172.16.0.0/24$), hosting an Azure Firewall with a private IP address of $172.16.0.4$. The application virtual network, `vnet-spoke-app` ($172.17.0.0/16$), is peered with `vnet-hub-transit` and contains two subnets: `snet-web` ($172.17.1.0/24$) and `snet-biz` ($172.17.2.0/24$). Another virtual network, `vnet-spoke-db` ($172.18.0.0/16$), contains the database tier and is also peered with `vnet-hub-transit`.

You need to configure a route table associated with `snet-web`. The routing configuration must meet the following requirements:
- Route all outbound internet traffic from `snet-web` through the Azure Firewall.
- Route all database-bound traffic from `snet-web` to `vnet-spoke-db` through the Azure Firewall.
- Ensure that VMs within `snet-web` can communicate directly with VMs in `snet-biz` without routing traffic through the firewall.

Which route configuration should you apply to the route table associated with `snet-web`?

An administrator is configuring a high-availability backend pool for a Standard SKU Azure Load Balancer. The backend pool contains several Azure Virtual Machines, but each virtual machine currently has a Basic SKU public IP address associated with its network interface. During deployment, the administrator encounters a validation failure. Which of the following configuration changes can resolve this validation mismatch? (Select two.)

A digital marketing agency is designing the compute infrastructure for a new campaign analytics platform. The platform must support two distinct workloads:

1. **Workload $1$**: A public-facing REST API that collects clickstream events from active marketing campaigns. The API is containerized, requires outbound virtual network (VNet) integration to access an Azure SQL Database via private endpoints, and experiences highly unpredictable demand, scaling down to $0$ instances during off-peak hours to eliminate idle costs. Minimal infrastructure management is a key priority.
2. **Workload $2$**: A data processing worker that aggregates campaign metrics daily. The worker is packaged as a container, runs as a single batch job that executes for approximately $40$ minutes, and requires access to local scratch disk storage for temporary data processing.

Which compute hosting architecture should you recommend to meet these requirements?

An organization is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-neure-hub-01` ($10.240.0.0/16$), contains an Azure Route Server in the `RouteServerSubnet` ($10.240.2.0/24$) and a pair of Network Virtual Appliances (NVAs) in `snet-nva` ($10.240.1.0/24$) that establish BGP sessions with the Route Server. The NVAs advertise on-premises network routes ($192.168.0.0/16$). You peer a spoke virtual network named `vnet-neure-spoke-app` ($10.241.0.0/24$) with `vnet-neure-hub-01`. You must ensure that virtual machines in `vnet-neure-spoke-app` can dynamically learn the routes advertised by the NVAs via Azure Route Server, without using User-Defined Routes (UDRs). Which two configurations should you implement?

A company is modernizing a web application that will be hosted in a single Azure region. The solution must meet the following requirements:
- Support SSL/TLS termination at the load balancer.
- Support URL path-based routing (HTTP/HTTPS).
- Provide regional zone-redundant high availability.
- Ensure the configuration does not fail validation due to SKU mismatches.

Which load balancing configuration should you recommend?

A healthcare technology provider is designing a SaaS application on Azure that will process patient telemetry data across two different regions: Germany and the United States.

The solution must meet the following requirements:
- Host a containerized processing microservice that scales dynamically based on the queue depth of an Azure Service Bus queue.
- Separate the logging and monitoring data of patient events to comply with strict regional data sovereignty laws in each country.
- Minimize administrative effort and infrastructure management overhead.

Which two components should you include in the design?

An enterprise is designing a serverless data processing pipeline in Azure to support a telemetry analysis system. The solution must host the following workloads:

- Workload 1: An event-driven API endpoint that ingests telemetry data. The workload must scale rapidly from $0$ to handle unpredictable traffic spikes, incur $0$ cost when idle, and route outbound traffic through an Azure Virtual Network to securely access a private database.
- Workload 2: A batch processing job that runs containerized custom simulation code triggered by telemetry events. The job must run for up to $45$ minutes per execution and dynamically scale down to $0$ instances when no simulations are active.

The architecture must minimize operational management overhead and monthly hosting costs.

Which two compute solutions should you recommend? (Select two.)

An organization has deployed a virtual network named `vnet-prod-uswest` ($10.110.0.0/16$) that contains two subnets: `subnet-web` ($10.110.1.0/24$) and `subnet-data` ($10.110.2.0/24$). A Network Virtual Appliance (NVA) is deployed in a peered hub virtual network at $10.120.1.4$.

The organization needs to inspect all traffic sent from `subnet-web` to `subnet-data` using the NVA. The solution must ensure that virtual machines within `subnet-web` can still communicate directly with each other without routing through the NVA.

Which route should be added to the route table associated with `subnet-web`?

An organization is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-shared`, has an address space of $10.100.0.0/16$ and contains an Azure VPN Gateway in `GatewaySubnet` ($10.100.0.0/24$) and a Network Virtual Appliance (NVA) at IP address $10.100.10.4$. The spoke virtual network, `vnet-spoke-app`, has an address space of $10.101.0.0/16$. The networks are connected via virtual network peering.

The design must meet the following requirements:
- Spoke virtual machines must route all internet-bound traffic through the NVA in the hub.
- Spoke virtual machines must communicate with an on-premises network ($172.16.0.0/12$) through the VPN Gateway.
- Spoke virtual machines must communicate directly with resources in the hub virtual network ($10.100.0.0/16$) without passing through the NVA.

Which two configurations should you include in the design? (Select two.)

An enterprise is designing a hub-and-spoke network topology in Azure for a multi-tier application. The architecture includes:

* A hub virtual network named `vnet-prod-hub` with an address space of $10.150.0.0/16$.
* `AzureFirewallSubnet` ($10.150.1.0/24$) containing an Azure Firewall with private IP $10.150.1.4$.
* `GatewaySubnet` ($10.150.2.0/24$) containing a Virtual Network Gateway connected to on-premises via ExpressRoute.
* A spoke virtual network named `vnet-prod-spoke` with an address space of $10.160.0.0/16$.
* Subnet `snet-compute` ($10.160.10.0/24$) hosting virtual machines.

The hub and spoke virtual networks are peered. The peering is configured to allow gateway transit on the hub and use remote gateways on the spoke.

The security requirements are:
1. All traffic from `snet-compute` destined for the internet must be routed through the Azure Firewall.
2. All traffic from `snet-compute` destined for the on-premises network ($172.16.0.0/12$) must be routed through the Virtual Network Gateway.
3. All traffic from `snet-compute` destined for the hub virtual network (`vnet-prod-hub`) must be routed through the Azure Firewall for security inspection.

To implement these requirements, a network architect creates a route table named `rt-spoke-routing` with the following user-defined routes (UDRs):
* Route 1: $0.0.0.0/0$ $\rightarrow$ Next hop: Virtual appliance ($10.150.1.4$)
* Route 2: $10.150.0.0/16$ $\rightarrow$ Next hop: Virtual appliance ($10.150.1.4$)

The architect associates `rt-spoke-routing` with the `snet-compute` subnet. To ensure symmetric inspection for return traffic, the architect also associates the same `rt-spoke-routing` route table with the `AzureFirewallSubnet`.

During post-deployment validation, VMs in `snet-compute` can successfully access the internet, but they cannot establish any connections to resources in the hub virtual network, and the Azure Firewall fails to pass traffic to the Gateway Subnet.

Which configuration change should the architect perform to resolve the connectivity issue while satisfying all design requirements?

An administrator needs to configure a Network Security Group (NSG) to allow outbound traffic from an Azure Virtual Network subnet to Azure SQL Database. The IP addresses for Azure SQL Database might change over time. The solution must minimize administrative overhead. Which NSG rule configuration should you recommend?

A logistics company is designing an event-driven system to generate end-of-day shipping manifests. The generation process reads transaction logs, formats reports, and takes between 12 and 18 minutes to complete per run. The process is triggered by a scheduler message in an Azure Service Bus queue. The company requires a compute solution that minimizes operational overhead and incurs costs only when executing. Which compute option should you recommend?

A financial firm is designing a secure network environment for a pool of virtual machines in a virtual network subnet named Subnet1. The design must meet the following requirements:
- The virtual machines must retrieve cryptographic keys from an Azure Key Vault.
- The virtual machines must be isolated behind a load balancer that distributes incoming traffic.
- All outbound traffic to the internet must be blocked except for connections to Azure Key Vault.
- The configuration must minimize administrative maintenance.

Which security and load balancing configuration should you recommend?

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-weur-hub` ($10.100.0.0/16$), contains an ExpressRoute Gateway in `GatewaySubnet`, an Azure Route Server in `RouteServerSubnet` ($10.100.1.0/24$), and a pair of active-passive Network Virtual Appliances (NVAs) in `NvaSubnet` ($10.100.2.0/24$). The spoke virtual network, `vnet-weur-spoke-prod` ($10.101.0.0/16$), is peered directly with the hub.

To implement security inspection, all egress traffic to the internet ($0.0.0.0/0$) from both the spoke and the hub must be routed through the NVA ($10.100.2.4$). The NVA advertises the $0.0.0.0/0$ route to the Azure Route Server via BGP.

Which two configurations must you implement to ensure routing functions correctly without routing loops or unsupported configurations?

An organization is designing a secure network architecture in Azure. The design includes:
- A subnet named Subnet-App hosting virtual machines that run an application.
- An Azure Key Vault that stores cryptographic keys.
- A Private Endpoint for the Key Vault deployed in a subnet named Subnet-Private with a private IP address of 10.10.2.4.

A Network Security Group (NSG) associated with Subnet-App must allow the virtual machines to access the Key Vault via the Private Endpoint. To meet security compliance, you must block all other outbound traffic from Subnet-App to both the internet and other resources within the virtual network.

Which configuration should you specify for the destination in the NSG outbound security rule on Subnet-App to meet the requirements with the least administrative effort?

An enterprise is designing a multi-tier application in an Azure virtual network named VNet1. The application consists of web servers, application servers, and database servers.

You need to design a network security strategy using Network Security Groups (NSGs) to isolate the traffic between these tiers. The strategy must meet the following requirements:
- Allow web servers to communicate only with the application servers.
- Allow application servers to communicate only with the database servers.
- Minimize administrative effort as virtual machines (VMs) are added or removed from each tier.
- Avoid the use of individual IP addresses in the security rules.

Which two actions should you include in the design?