Examkin

Design Infrastructure Solutions

360 questions

All types360Multiple choice189Multiple select171
Question 261Question →

An enterprise is modernizing a global HR SaaS application. The application consists of two main tiers:

1. A web application tier (HTTP/HTTPS) that requires SSL/TLS termination, URL path-based routing (e.g., routing `/benefits/*` and `/payroll/*` to different backend pools), and global optimization to route users to the closest region (either East US or West Europe).
2. A background data-sync tier that communicates using a custom TCP protocol on port 9090, requiring high-throughput regional layer 4 load balancing in the East US region.

The existing virtual machines for the background data-sync tier in East US are configured with Basic SKU Public IP addresses.

You need to design the application load balancing and delivery solution to meet these requirements while preventing configuration validation errors.

Which of the following actions should you recommend? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Azure Front Door to route global HTTP/HTTPS traffic, terminate SSL, and perform URL path-based routing for the web application tier.; Deploy a Standard Load Balancer to distribute the custom TCP traffic for the background data-sync tier, and upgrade the background VMs' Public IPs to Standard SKU.

Answer

To meet the global routing, path-based routing, and SSL termination requirements for the HTTP/S web application tier, Azure Front Door is the appropriate service. For the regional TCP-based background data-sync tier, a Standard Load Balancer must be used; however, to prevent SKU mismatch validation errors, the associated virtual machines' Public IPs must be upgraded from Basic to Standard SKU.
The correct recommendations are to deploy Azure Front Door for the web tier and deploy a Standard Load Balancer for the background tier while upgrading the background virtual machines' Public IPs to the Standard SKU. Azure Front Door satisfies all global layer 7 requirements, including SSL termination, path-based routing, and global user optimization. The Standard Load Balancer handles regional TCP load balancing on port 9090. Upgrading the virtual machines' Public IPs to Standard SKU is necessary because Standard Load Balancers do not support backend resources with Basic SKU Public IPs, preventing configuration validation failures.

Step-by-Step Solution

1
Analyze the requirements for the global web application tier.
Identify that global load balancing, HTTP/S protocol support, SSL/TLS termination, and URL path-based routing are required.
These layer 7 and global routing requirements point directly to Azure Front Door, as it manages global HTTP/S traffic with path routing and SSL offloading.
2
Analyze the requirements for the regional background data-sync tier.
Identify that regional load balancing on a custom TCP port (9090) is required.
A layer 4 load balancer is needed. Azure Load Balancer (Standard SKU) is the correct choice to handle non-HTTP/S TCP traffic regionally.
3
Evaluate the SKU compatibility for the regional load balancer configuration.
Identify that the existing virtual machines have Basic SKU Public IPs, which cannot be associated with a Standard Load Balancer backend pool.
To avoid a validation error caused by mixing Basic and Standard SKUs, the Public IPs on the background virtual machines must be upgraded to Standard SKU.

Key Concept

Selecting Azure load balancing services based on layer, scope, and SKU compatibility constraints.
Question 262Question →

A company named Zephyr Retail is designing a network security solution for an Azure virtual network subnet named ProcessingSubnet. Virtual machines in ProcessingSubnet must be able to securely access Azure Storage and Azure Key Vault in the same Azure region. All other outbound access to the public internet must be blocked. The solution must minimize administrative overhead and ensure that network rules do not require manual updates when Azure service IP ranges change. Which configuration should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?

Show answer & explanation

Answer: Create outbound security rules in the NSG with the destination set to the Storage and AzureKeyVault Service Tags.

Answer

Create outbound security rules in the NSG with the destination set to the Storage and AzureKeyVault Service Tags.
Using Service Tags like Storage and AzureKeyVault allows the Network Security Group to dynamically resolve destination IP addresses, ensuring secure and continuously updated access to these services with zero administrative overhead.

Step-by-Step Solution

1
Identify the target public Azure services that the virtual machines need to reach.
Azure Storage and Azure Key Vault in the same region.
This establishes the scope of allowed outbound traffic.
2
Evaluate the administrative requirement to avoid manual IP range updates.
Individual IP addresses are ruled out; a dynamic grouping mechanism must be used.
Azure service IP ranges change frequently, so static IP rules create maintenance overhead.
3
Select the built-in Azure Network Security Group features designed for grouping service IP addresses.
Service Tags (specifically Storage and AzureKeyVault) are selected.
Service Tags are managed by Microsoft and automatically updated, satisfying the requirement to minimize administrative overhead.

Key Concept

Network Security Groups and Service Tags for outbound traffic filtering
Estimated Time:1m 30s
Question 263Question →

An organization plans to migrate its legacy inventory management application to Azure. The current workload runs on 1515 physical bare-metal servers hosting Windows Server 20162016. The application uses a backend Microsoft SQL Server 20162016 instance containing multiple databases that rely on SQL Server Agent jobs and cross-database queries.

You need to design a migration assessment and transition strategy that meets the following requirements:
1. Identify and map all network dependencies, process communication paths, and ports across the 1515 physical servers using Azure Migrate.
2. Recommend a fully managed Azure SQL database hosting option that natively supports SQL Server Agent and cross-database queries.
3. Configure a hybrid identity synchronization method that allows on-premises Active Directory Domain Services (AD DS) users to authenticate to Azure resources without deploying any on-premises federation servers.

Which combination of solutions should you recommend?

Show answer & explanation

Answer: Perform agent-based dependency analysis by deploying the Azure Migrate appliance and installing the Azure Monitor Agent and Dependency Agent on each of the 1515 physical servers. Migrate the databases to Azure SQL Managed Instance. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO).

Answer

The strategy recommending agent-based dependency mapping using the Azure Monitor Agent and Dependency Agent, Azure SQL Managed Instance, and Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO
The option recommending agent-based dependency mapping, Azure SQL Managed Instance, and Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO is correct. Agent-based dependency mapping is mandatory for physical servers since agentless discovery and mapping are only supported for virtualized VMware and Hyper-V workloads. Azure SQL Managed Instance natively supports instance-level features like SQL Server Agent and cross-database queries. Finally, PHS with Seamless SSO provides authentication without requiring federation servers on-premises, satisfying the identity configuration constraints.

Step-by-Step Solution

1
Determine the dependency mapping strategy for physical bare-metal servers.
Identify that Azure Migrate only supports agentless dependency mapping for VMware and Hyper-V environments. For physical servers, agent-based mapping using the Azure Monitor Agent and Dependency Agent is required.
Correctly matching the server type (physical bare-metal) to the supported Azure Migrate dependency mapping methodology.
2
Select the correct Azure SQL hosting tier for SQL Server features.
Select Azure SQL Managed Instance since it provides near-100% compatibility with on-premises SQL Server databases, natively supporting SQL Server Agent and cross-database queries, unlike Azure SQL Database single databases or elastic pools.
Ensuring application compatibility without code refactoring for database engine features.
3
Select the appropriate hybrid identity synchronization method.
Choose Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO) as it allows AD DS users to authenticate to Azure resources without deploying dedicated AD FS federation servers.
Aligning hybrid identity design with on-premises infrastructure constraints.
4
Synthesize the results to identify the matching option.
Select the option combining agent-based dependency analysis, Azure SQL Managed Instance, and PHS with Seamless SSO.
Ensuring all requirements are satisfied by a single option.

Key Concept

Migration Assessment and Strategy
Estimated Time:3m 0s
Question 264Question →

An enterprise is designing an Azure hub-and-spoke virtual network topology to support their internal workloads. The topology is configured as follows:

* The hub virtual network, `vnet-hub-core`, has an address space of 172.16.0.0/16172.16.0.0/16 and hosts an Azure Firewall at 172.16.1.4172.16.1.4.
* A spoke virtual network, `vnet-spoke-app`, has an address space of 172.18.0.0/16172.18.0.0/16 and contains a subnet named `subnet-app` (172.18.1.0/24172.18.1.0/24).
* A second spoke virtual network, `vnet-spoke-shared`, has an address space of 172.19.0.0/16172.19.0.0/16.
* Both spoke virtual networks are peered directly with `vnet-hub-core`. Spoke-to-spoke peering is not configured.

To meet corporate security policies, all traffic originating from `subnet-app` that is destined for the Internet, `vnet-spoke-shared`, and `vnet-hub-core` must be routed through the Azure Firewall for inspection.

An administrator associates a route table with `subnet-app` containing the following custom routes:

* Route 1: Address prefix 0.0.0.0/00.0.0.0/0, Next hop: Virtual appliance (172.16.1.4172.16.1.4)
* Route 2: Address prefix 172.16.0.0/12172.16.0.0/12, Next hop: Virtual appliance (172.16.1.4172.16.1.4)

Which routing behavior will occur for traffic originating from `subnet-app`?

Show answer & explanation

Answer: Traffic destined for the Internet and vnet-spoke-shared will route through the Azure Firewall, but traffic destined for vnet-hub-core will bypass the firewall and route directly through the peering connection.

Answer

Traffic destined for the Internet and vnet-spoke-shared will route through the Azure Firewall, but traffic destined for vnet-hub-core will bypass the firewall and route directly through the peering connection.
The correct answer is correct because Azure routing uses the longest prefix match (LPM) rule. For traffic destined to the hub virtual network (172.16.0.0/16), the system route created by the virtual network peering (172.16.0.0/16) is a longer match (/16) than the user-defined route (172.16.0.0/12, which is /12). Therefore, the system route is preferred, and the traffic bypasses the firewall. For traffic destined to the second spoke (172.19.0.0/16), the system route for the peered hub does not match, so the user-defined route of 172.16.0.0/12 is the longest matching route and sends the traffic to the firewall.

Step-by-Step Solution

1
Identify the system routes automatically generated for subnet-app in vnet-spoke-app.
The system routes include 172.18.0.0/16 (Local), 172.16.0.0/16 (VNet Peering to vnet-hub-core), and 0.0.0.0/0 (Internet). No route exists for 172.19.0.0/16 because peering is non-transitive.
Understanding system-defined routing is required before evaluating how custom user-defined routes (UDRs) modify behavior.
2
Evaluate the routing path for traffic destined for vnet-hub-core (172.16.0.0/16) by comparing route prefix lengths.
The destination matches both the system route 172.16.0.0/16 and the UDR 172.16.0.0/12. Since /16 is a longer prefix match than /12, the system route is preferred.
Azure routing utilizes Longest Prefix Match (LPM) to determine the next hop when multiple routes match a destination.
3
Evaluate the routing path for traffic destined for vnet-spoke-shared (172.19.0.0/16).
The destination matches the UDR 172.16.0.0/12 and UDR 0.0.0.0/0. The system route for the peered hub (172.16.0.0/16) does not match. The longest prefix match is the UDR 172.16.0.0/12, routing traffic to the firewall.
Since peering is non-transitive, no /16 system route exists for the other spoke, allowing the /12 UDR to successfully route this traffic to the firewall.

Key Concept

Azure routing selection prioritizes the longest prefix match (LPM) among all matching routes. A User Defined Route (UDR) with a shorter prefix length than a system-defined route will not override that system route.
Estimated Time:1m 30s
Question 265Question →

A shipping logistics company is designing an Azure compute solution for its new transit tracking application. The application consists of two main components:

1. Real-time Route Calculator: A stateful service that runs continuously to update delivery estimates. It requires stable, predictable CPU performance and must meet a strict service level agreement (SLA) for uptime.
2. Historical Analytics Processor: A processing job that runs nightly to analyze route efficiency. The job can be interrupted and resumed without impact, and minimizing compute cost is the highest priority.

Which of the following compute virtualization configurations should you recommend to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy the Real-time Route Calculator on standard on-demand Azure Virtual Machines.; Deploy the Historical Analytics Processor on Azure Spot Virtual Machines.

Answer

Deploy the Real-time Route Calculator on standard on-demand Azure Virtual Machines and deploy the Historical Analytics Processor on Azure Spot Virtual Machines.
Deploying the continuous, SLA-bound Real-time Route Calculator on standard on-demand VMs ensures stable, uninterrupted performance. Deploying the interruptible, cost-sensitive Historical Analytics Processor on Azure Spot VMs achieves the maximum cost savings while tolerating potential evictions.

Step-by-Step Solution

1
Analyze the requirements of the Real-time Route Calculator workload.
Identified that the workload runs continuously, requires stable CPU performance, and must meet a strict uptime SLA.
This workload requires standard on-demand Virtual Machines to prevent unexpected evictions and ensure predictable performance.
2
Analyze the requirements of the Historical Analytics Processor workload.
Identified that the workload is an interruptible nightly batch job where minimizing compute cost is the highest priority.
This workload is a perfect candidate for Azure Spot Virtual Machines, which offer deep discounts in exchange for accepting potential runtime evictions.
3
Evaluate the proposed configurations against best practices.
Confirms that standard on-demand VMs meet the SLA for the calculator service, and Spot VMs meet the cost requirements for the batch processor.
This configuration satisfies all technical requirements and business constraints without introducing availability risks to production or unnecessary costs.

Key Concept

Selecting appropriate VM purchase models (on-demand vs. Spot) and redundancy configurations based on workload SLA and cost requirements.
Question 266Question →

A company named Aetheris Manufacturing is designing the network security architecture for a new web application. The application runs on Azure Virtual Machines deployed in a subnet named AppSubnet within a virtual network named VNet1. The application requires access to an Azure SQL Database and must retrieve configuration secrets from an Azure Key Vault. The application must also authenticate users using Microsoft Entra ID. You need to design a security solution that meets the following requirements:
- Restrict all outbound internet access from AppSubnet, except for the traffic required for Microsoft Entra ID authentication and Azure Key Vault access.
- Ensure the virtual machines access the Azure SQL Database using private IP addresses.
- Minimize the administrative and operational effort required to maintain network security rules.
- Avoid manually defining and updating public IP address ranges in network security rules.

Which two actions should you include in the design?

Select all that apply

Show answer & explanation

Answer: Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1.; Associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.

Answer

Deploy a Private Endpoint for the Azure SQL Database in a dedicated subnet within VNet1, and associate a Network Security Group (NSG) with AppSubnet and configure outbound rules that allow traffic to the AzureActiveDirectory and AzureKeyVault service tags, followed by a lower-priority rule that denies outbound traffic to the Internet service tag.
Deploying a Private Endpoint for the Azure SQL Database ensures that database traffic is kept entirely within the private network, satisfying the requirement to access it via private IP addresses. For the security rules, using the built-in AzureActiveDirectory and AzureKeyVault service tags within the Network Security Group (NSG) allows authentication and Key Vault traffic while blocking all other outbound internet traffic. This avoids manual IP list maintenance and fulfills the requirement to minimize administrative and operational effort.

Step-by-Step Solution

1
Analyze database connectivity requirements
Identify that a Private Endpoint is needed to assign a private IP address to the Azure SQL Database.
This satisfies the requirement to avoid exposing the database publicly and allows secure access via internal IPs.
2
Determine service access security parameters
Identify that Microsoft Entra ID and Azure Key Vault require outbound connectivity, which should be secured using built-in service tags rather than individual IP rules.
Service tags minimize administrative overhead by dynamically maintaining IP address ranges for Azure services.
3
Apply Network Security Group configurations
Associate the NSG to the application subnet, adding rules to allow AzureActiveDirectory and AzureKeyVault outbound traffic, followed by a lower-priority rule to deny outbound traffic to the Internet.
This configuration enforces the restriction of general internet access while maintaining operational access to key services.

Key Concept

Azure Private Endpoints and Network Security Group Service Tags
Question 267Question →

An enterprise is modernizing a media streaming platform in Azure. The system consists of two primary endpoints:

1. A management API endpoint that receives HTTP/HTTPS control messages on port 443. The API requires URL path-based routing (e.g., `/stream/start` vs `/stream/stop`) and SSL/TLS termination.
2. A real-time video stream ingestion endpoint that receives continuous UDP traffic on port 8080.

The backend virtual machines (VMs) processing both workloads are deployed within a Virtual Machine Scale Set (VMSS) across multiple Availability Zones for high availability. To reduce costs, the networking team proposes deploying:

* An Azure Application Gateway (Standard v2) to load balance the HTTP/HTTPS management API.
* A Basic SKU Azure Load Balancer to load balance the UDP streaming traffic.

Why will the proposed load balancing configuration fail to deploy?

Show answer & explanation

Answer: The virtual machine scale set instances cannot be associated with both the Standard SKU Application Gateway and the Basic SKU Load Balancer backend pools simultaneously, as mixing Basic and Standard SKU load balancing resources on the same network interfaces is not supported.

Answer

The virtual machine scale set instances cannot be associated with both the Standard SKU Application Gateway and the Basic SKU Load Balancer backend pools simultaneously, as mixing Basic and Standard SKU load balancing resources on the same network interfaces is not supported.
The correct answer states that the virtual machine scale set instances cannot belong to both a Standard SKU resource (Application Gateway v2) and a Basic SKU Load Balancer backend pool at the same time. Azure enforces strict SKU isolation at the network interface (NIC) level, meaning all load balancers or application gateways attached to a VM's NIC must share the same SKU level (Standard or Basic). Mixing SKUs results in deployment validation failures.

Step-by-Step Solution

1
Analyze the protocol and routing requirements for both endpoints.
The management API requires Layer 7 routing (HTTP/HTTPS, path-based routing, SSL termination), making Azure Application Gateway appropriate. The streaming ingest requires Layer 4 routing (UDP on port 8080), which requires Azure Load Balancer.
Application Gateway does not support UDP traffic, necessitating a separate Layer 4 load balancer.
2
Assess the SKU compatibility rules for Azure Load Balancer and Application Gateway.
Application Gateway Standard v2 functions as a Standard SKU resource. The proposed Load Balancer is a Basic SKU resource. Registering the same virtual machine network interfaces to backend pools of different SKUs violates SKU isolation policies.
Azure prevents registering a network interface card (NIC) to a mix of Basic and Standard SKU load balancing resources.
3
Identify the necessary remediation steps.
Upgrade the Basic SKU Load Balancer to a Standard SKU Load Balancer.
Using a Standard Load Balancer aligns the SKU level with the Application Gateway Standard v2, resolving the validation failure while supporting the zone-redundant backend VM configuration.

Key Concept

Load Balancer SKU compatibility and co-existence constraints
Estimated Time:2m 30s
Question 268Question →

A company plans to migrate its on-premises environment to Azure. The environment consists of ten virtual machines running on a Nutanix AHV cluster, four physical servers running Oracle Solaris, and a Microsoft SQL Server 2016 failover cluster instance hosting databases that utilize cross-database queries. You need to design a migration assessment and dependency mapping strategy. The strategy must discover all server workloads, assess their readiness, identify all network and application dependencies, and identify the correct database migration target while preserving database features. Which two actions should you include in the strategy? Choose two.

Select all that apply

Show answer & explanation

Answer: Deploy the Azure Migrate appliance configured for physical or other servers to discover the Nutanix AHV virtual machines.; Install the Dependency agent and the Log Analytics agent on the Solaris servers and Nutanix AHV virtual machines.

Answer

Deploy the Azure Migrate appliance configured for physical or other servers to discover the Nutanix AHV virtual machines, and install the Dependency agent and the Log Analytics agent on the Solaris servers and Nutanix AHV virtual machines.
Deploying the Azure Migrate appliance configured for physical or other servers is correct because Azure Migrate does not have native hypervisor-level integration for Nutanix AHV; therefore, these workloads must be discovered and assessed using the physical server workflow. Installing the Dependency agent and Log Analytics agent is correct because agentless dependency analysis is only supported for VMware and Hyper-V virtual machines. For physical servers and other hypervisors, agent-based dependency mapping is required to visualize network connections.

Step-by-Step Solution

1
Determine the discovery method for Nutanix AHV workloads.
Identify that because Azure Migrate lacks native hypervisor integration for Nutanix AHV, these virtual machines must be discovered using the physical server discovery workflow via the Azure Migrate appliance.
This allows successful discovery and inventory collection of the Nutanix AHV VMs.
2
Determine the dependency analysis method for physical and Nutanix AHV servers.
Determine that agentless dependency mapping is not supported for physical or other non-VMware/Hyper-V platforms, requiring the deployment of the Dependency agent and Log Analytics agent.
Agent-based dependency mapping is mandatory for physical servers and Nutanix AHV to capture application connections.
3
Evaluate the database tier requirements based on cross-database queries.
Rule out Azure SQL Database elastic pools and single databases, confirming that Azure SQL Managed Instance is the minimal relational database tier that supports cross-database queries.
Ensures feature parity and legacy application compatibility without rewriting queries.

Key Concept

Designing migration discovery, dependency mapping, and relational database targeting based on platform compatibility and technical limitations.
Question 269Question →

A retail company is designing a serverless architecture for a new inventory management system. The architecture must support two workloads:

1. A public-facing REST API that serves product catalog details, which experiences unpredictable traffic spikes and must minimize costs by scaling to zero during idle periods.
2. A nightly batch synchronization job that updates inventory levels from an external warehouse database, which runs to completion, takes up to 45 minutes to execute, and requires a custom runtime environment.

To minimize administrative overhead and runtime hosting costs, which hosting configuration should you recommend?

Show answer & explanation

Answer: Azure Functions on a Consumption plan to host the REST API, and Azure Container Apps Jobs to run the nightly synchronization job

Answer

Azure Functions on a Consumption plan to host the REST API, and Azure Container Apps Jobs to run the nightly synchronization job
The correct architecture uses Azure Functions on a Consumption plan for the REST API, as it scales to zero during idle periods and scales out automatically to handle unpredictable traffic spikes. For the nightly synchronization job, Azure Container Apps Jobs is the optimal choice because it is designed for run-to-completion tasks, allows executions up to 24 hours, scales to zero when not running, and requires low administrative management compared to hosting Kubernetes clusters.

Step-by-Step Solution

1
Analyze the scaling and cost requirements for the REST API workload.
The REST API requires rapid scaling to handle traffic spikes and the ability to scale to zero to minimize idle hosting costs. Azure Functions on a Consumption plan perfectly matches these requirements.
Azure Functions Consumption plan is billed only when functions are running and scales automatically based on incoming events.
2
Evaluate the constraints of the nightly synchronization job.
The synchronization job runs for up to 45 minutes and is a run-to-completion batch task.
This duration exceeds the 10-minute maximum execution limit of the Azure Functions Consumption plan, ruling it out.
3
Select the optimal hosting option for the long-running batch job that minimizes costs and administrative overhead.
Azure Container Apps Jobs is designed specifically for transient, run-to-completion tasks, can run up to 24 hours, and charges only for the duration of execution, meaning zero baseline costs when idle.
Unlike AKS, which requires significant cluster management, or Dedicated/Premium App Service plans, which incur constant baseline costs even when idle, Azure Container Apps Jobs provides a serverless model with minimal administrative overhead.

Key Concept

Selecting appropriate serverless hosting options based on execution time limits, scaling characteristics, and operational overhead.
Question 270Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-central`, uses the IP address space 10.10.0.0/1610.10.0.0/16 and hosts an Azure Firewall at 10.10.1.410.10.1.4. There are two spoke virtual networks: `vnet-app-prod` (10.20.0.0/1610.20.0.0/16) and `vnet-db-prod` (10.30.0.0/1610.30.0.0/16). Both spokes are peered directly to `vnet-hub-central`. You need to ensure that all network traffic between `vnet-app-prod` and `vnet-db-prod` is routed through the Azure Firewall for security inspection, while ensuring that resources within `vnet-app-prod` can communicate with each other directly without routing local traffic through the firewall. Which two configurations should you implement? (Select two.)

Select all that apply

Show answer & explanation

Answer: A route table associated with the subnet in `vnet-app-prod` that contains a route for 10.30.0.0/1610.30.0.0/16 with a next hop of Virtual Appliance pointing to 10.10.1.410.10.1.4; A route table associated with the subnet in `vnet-db-prod` that contains a route for 10.20.0.0/1610.20.0.0/16 with a next hop of Virtual Appliance pointing to 10.10.1.410.10.1.4

Answer

Configure a route table associated with the subnet in the application spoke VNet with a route for the database spoke prefix pointing to the Azure Firewall, and configure another route table associated with the subnet in the database spoke VNet with a route for the application spoke prefix pointing to the Azure Firewall.
The correct solution involves configuring specific route tables in each spoke VNet to direct traffic destined for the opposite spoke VNet to the Azure Firewall's private IP address. By targeting only the remote spoke's IP space (10.30.0.0/1610.30.0.0/16 for the application spoke, and 10.20.0.0/1610.20.0.0/16 for the database spoke), traffic destined for the other spoke is successfully routed to the firewall, while traffic within the local spoke continues to use the default system Local route.

Step-by-Step Solution

1
Identify the routing path requirements between spokes.
Traffic from the application spoke (10.20.0.0/1610.20.0.0/16) destined for the database spoke (10.30.0.0/1610.30.0.0/16) must transit the firewall (10.10.1.410.10.1.4) in the hub VNet (10.10.0.0/1610.10.0.0/16).
This establishes security inspection requirements for cross-spoke communication.
2
Define the user-defined route for the application spoke subnet.
Add a UDR for destination 10.30.0.0/1610.30.0.0/16 with a next hop of Virtual Appliance (10.10.1.410.10.1.4).
This overrides the default direct peering routing and forces traffic outbound to the database spoke to flow through the firewall.
3
Define the user-defined route for the database spoke subnet.
Add a UDR for destination 10.20.0.0/1610.20.0.0/16 with a next hop of Virtual Appliance (10.10.1.410.10.1.4).
This ensures symmetric routing, allowing the response traffic from the database spoke to return through the firewall.
4
Verify local subnet routing behavior.
Ensure no UDRs are created targeting the local VNet's own CIDR block (i.e., do not configure 10.20.0.0/1610.20.0.0/16 in the application spoke, or 10.30.0.0/1610.30.0.0/16 in the database spoke).
This prevents overriding the default local system route, maintaining direct and unhindered internal communication within the spoke VNets.

Key Concept

Azure Virtual Network Peering and User Defined Routes (UDRs)
Estimated Time:1m 30s
Question 271Question →

A financial services company is designing the Azure compute virtualization solution for a new core payment processing application. The application will run continuously (24/724/7) and requires a highly available infrastructure with a 99.99%99.99\% SLA. Due to strict regulatory compliance, the application must run on isolated physical hardware dedicated to the company, and the virtual machines require a high memory-to-vCPU ratio to support caching massive transaction tables. Which compute solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Azure Dedicated Hosts running Esv5-series Virtual Machines deployed across multiple Availability Zones

Answer

Azure Dedicated Hosts running Esv5-series Virtual Machines deployed across multiple Availability Zones
The correct option is the deployment of Azure Dedicated Hosts running Esv5-series Virtual Machines across multiple Availability Zones. This combination satisfies all criteria: Azure Dedicated Hosts ensure physical isolation at the hardware host level to meet compliance; Esv5-series VMs are memory-optimized, offering the high memory-to-vCPU ratio required for in-memory caching; and utilizing multiple Availability Zones ensures the resilience needed to meet the high availability SLA.

Step-by-Step Solution

1
Analyze the isolation requirement
The requirement for isolated physical hardware dedicated to the company points to Azure Dedicated Hosts.
Azure Dedicated Hosts provide physical servers dedicated to a single Azure subscription, satisfying strict physical isolation and regulatory requirements.
2
Analyze the workload characteristics and sizing requirements
The requirement for a high memory-to-vCPU ratio for caching transaction tables points to memory-optimized virtual machine families, such as the Esv5-series.
Esv5-series virtual machines are memory-optimized and provide a high memory-to-vCPU ratio, unlike general-purpose or storage-optimized series.
3
Analyze the availability and continuity requirements
The 24/724/7 continuous operation and 99.99%99.99\% SLA require deploying across multiple Availability Zones and avoiding Spot VMs.
Spot VMs are subject to eviction and do not support SLAs, while deploying in a single zone exposes the application to zone-level failures, preventing the team from meeting the 99.99%99.99\% SLA.

Key Concept

Selecting Azure compute hosting options, virtual machine families, and availability configurations based on compliance, performance, and SLA constraints.
Question 272Question →

You are conducting an architectural review for a smart city traffic monitoring system. The system requires two primary workloads to be hosted in Azure:

1. A public API endpoint for transit queries that experiences severe traffic spikes during rush hours and long periods of inactivity overnight. To optimize cost, it must scale to zero instances when idle.
2. A background analytics worker that processes traffic camera footage. Each execution is triggered by a file upload, runs a custom computer vision model, and takes up to 20 minutes to complete.

To meet these requirements with the lowest operational overhead and cost, which two components should you include in your design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the public API endpoint; Azure Container Apps Jobs to run the background analytics worker

Answer

Azure Container Apps to host the public API endpoint and Azure Container Apps Jobs to run the background analytics worker.
Azure Container Apps is the optimal solution for the public API endpoint because it supports automatic scaling down to zero instances when there is no traffic, effectively reducing costs during inactive hours. Azure Container Apps Jobs is the correct solution for the background analytics worker because it provides containerized execution for run-to-completion, event-triggered tasks without being restricted by the 10-minute execution limit that applies to standard Azure Functions Consumption plans.

Step-by-Step Solution

1
Analyze the scaling and cost requirements of the public API endpoint.
The API endpoint requires scale-to-zero capabilities to minimize idle costs and must handle spiky traffic, pointing to Azure Container Apps as the optimal low-overhead hosting choice.
Azure Container Apps natively supports scaling to zero based on HTTP traffic using KEDA, avoiding the operational complexity of Azure Kubernetes Service (AKS).
2
Evaluate the execution time constraint of the background analytics worker.
The worker runs for up to 20 minutes per execution, which exceeds the maximum execution timeout of 10 minutes for Azure Functions on a Consumption plan.
Choosing Azure Functions on a Consumption plan would lead to timeout failures, making Azure Container Apps Jobs the correct choice for run-to-completion tasks that exceed standard serverless timeouts.

Key Concept

Designing serverless hosting solutions requires balancing execution time limits (such as the 10-minute timeout of Azure Functions Consumption plans) against scaling requirements (such as scale-to-zero capabilities) and operational complexity.
Question 273Question →

An organization plans to migrate a legacy three-tier web application hosted on-premises on a Hyper-V failover cluster to Azure. The application database tier consists of two Microsoft SQL Server virtual machines that execute cross-database queries. The application tier has strict low-latency requirements for database communication. The company wants to implement Microsoft Entra ID for hybrid identity but does not have any regulatory or technical requirements for federated authentication methods.

Which two actions should you include in the migration assessment and strategy? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Configure agentless or agent-based dependency analysis in Azure Migrate to identify network communication patterns and group dependent servers.; Recommend Azure SQL Managed Instance as the migration target for the database servers to support the cross-database queries.

Answer

Configure agentless or agent-based dependency analysis in Azure Migrate to identify network communication patterns and group dependent servers, and recommend Azure SQL Managed Instance as the migration target for the database servers to support the cross-database queries.
The correct strategy requires performing dependency analysis to map server relationships and support low-latency grouping, while choosing Azure SQL Managed Instance to support cross-database queries.

Step-by-Step Solution

1
Analyze database compatibility requirements.
Identify that the database requires cross-database queries, ruling out Azure SQL Database single databases and directing the choice to Azure SQL Managed Instance.
Ensures the application's query features function correctly in Azure without requiring code refactoring.
2
Analyze database connectivity and latency requirements.
Identify that the multi-tier application needs low latency and has database dependencies, requiring dependency analysis mapping.
Allows grouping dependent virtual machines into the same migration wave to prevent latency issues.
3
Evaluate hybrid identity requirements.
Confirm that there are no technical or regulatory reasons requiring federation.
Avoids the deployment of AD FS, which carries high maintenance and overhead.

Key Concept

Identifying database compatibility features and network dependencies is critical to designing a successful Azure migration assessment and strategy.
Estimated Time:2m 0s
Question 274Question →

An enterprise is modernizing a legacy web application in a single Azure region. The application requires routing incoming HTTP/HTTPS traffic to different virtual machine scale sets based on the URL path (such as routing `/api/*` to a dedicated API pool and `/web/*` to a web pool). The design must support SSL/TLS termination at the load balancing tier to offload decryption overhead from the backend instances. Additionally, administrative access to individual virtual machines must be preserved via Basic SKU Public IP addresses currently assigned directly to their network interfaces, and the load balancing solution must be restricted to regional distribution within the primary virtual network. Which of the following configuration options should the architect recommend?

Show answer & explanation

Answer: Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.

Answer

Deploy an Azure Application Gateway (Standard v2) and configure the backend pools to target the private IP addresses of the virtual machines.
The correct option is the deployment of Azure Application Gateway (Standard v2) targeting the backend VMs' private IP addresses. Application Gateway is a regional Layer 7 load balancer that natively supports SSL/TLS termination and URL path-based routing. By configuring the backend pool to target the VMs' private IP addresses within the virtual network, the design remains regional and avoids SKU mismatch conflicts that occur when mixing Basic SKU public IPs with Standard SKU public load balancers.

Step-by-Step Solution

1
Analyze the load balancing protocol and routing requirements.
The requirements specify URL-based routing (`/api/*` and `/web/*`) and SSL/TLS termination, which necessitates a Layer 7 load balancing solution (Azure Application Gateway or Azure Front Door). Layer 4 options like Azure Load Balancer are eliminated.
URL path-based routing and SSL termination require inspection and termination of the HTTP/HTTPS sessions at the load balancer level.
2
Analyze the geographic and networking requirements.
The solution must be restricted to regional distribution within a single Azure region and integrated within the primary virtual network. This eliminates Azure Front Door, which is a global service.
Azure Application Gateway operates regionally within a virtual network subnet, satisfying the regional routing constraint.
3
Evaluate SKU compatibility and backend integration for the virtual machines.
The backend virtual machines utilize Basic SKU Public IPs on their NICs. Standard Load Balancer backend pools require Standard SKU IPs if public IPs are used, but Application Gateway can target the private IP addresses of the VMs within the VNet, avoiding any SKU validation errors.
Targeting private IPs prevents the mixing of Basic and Standard SKUs on the public-facing components of the load balancer architecture.

Key Concept

Azure Application Gateway provides regional Layer 7 load balancing, SSL offloading, and URL path-based routing while integrating with backends via private IP addresses to avoid SKU mismatch conflicts.
Question 275Question →

A legal services company is implementing a serverless worker that compiles large case files into a single PDF document. The compilation process is CPU-intensive and typically runs for 11 to 14 minutes per request. The company wants a fully managed serverless compute option that scales to zero to minimize costs during periods of inactivity, and they want to avoid the administrative overhead of managing underlying container clusters or virtual machines. Which Azure service should you select to meet these requirements?

Show answer & explanation

Answer: Azure Container Apps Jobs

Answer

Azure Container Apps Jobs
Azure Container Apps Jobs are ideal for run-to-completion tasks that require containerized environments without the complexity of AKS. They support execution times beyond 10 minutes, trigger dynamically on events or schedules, scale to zero when idle to save costs, and are fully managed by Azure.

Step-by-Step Solution

1
Analyze the execution duration requirement.
The compilation runs for 11 to 14 minutes, which is longer than the 10-minute maximum limit of the standard serverless execution environment of Azure Functions on a Consumption plan.
Identifying runtime requirements helps prevent execution timeouts.
2
Evaluate administrative and management overhead limits.
The requirement specifies avoiding cluster or virtual machine management, ruling out self-managed solutions.
Choosing a fully managed service satisfies the operational overhead constraints.
3
Match the workload type to the optimal serverless execution model.
Azure Container Apps Jobs support long-running, event-triggered tasks that scale to zero, meeting all criteria.
Selecting the service designed for run-to-completion containerized tasks ensures reliability and cost-efficiency.

Key Concept

Selecting serverless hosting options based on execution limits and management overhead constraints.
Question 276Question →

Solaria Energy is designing a secure architecture for a cloud-based analytics system. The system consists of a virtual network named VNet-Analytics containing a subnet named Processing-Subnet. Virtual machines in Processing-Subnet must securely access an Azure SQL Database instance and an Azure Key Vault.

The design must meet the following requirements:
- All traffic to Azure SQL Database and Azure Key Vault must remain within the Microsoft backbone network.
- Virtual machines in Processing-Subnet must resolve the database and key vault hostnames using their private IP addresses.
- Public endpoint access to the Azure SQL Database and Azure Key Vault must be fully disabled.
- The solution must minimize administrative overhead.

Which two actions should you include in the design to meet the requirements?

Select all that apply

Show answer & explanation

Answer: Create a private endpoint for the Azure SQL Database and a private endpoint for the Azure Key Vault.; Configure a private DNS zone named privatelink.database.windows.net and a private DNS zone named privatelink.vaultcore.azure.net, and link both zones to VNet-Analytics.

Answer

Create a private endpoint for each service and configure the corresponding private DNS zones linked to the virtual network.
The correct architecture requires creating a private endpoint for the Azure SQL Database and another for the Azure Key Vault. This exposes them via private IPs on the virtual network and allows disabling public access. Additionally, the corresponding Azure Private DNS zones (privatelink.database.windows.net and privatelink.vaultcore.azure.net) must be configured and linked to the virtual network to ensure the virtual machines resolve the service hostnames to their private IP addresses.

Step-by-Step Solution

1
Identify the private access method that keeps traffic on the Microsoft backbone and allows disabling public endpoints.
Determine that Azure Private Endpoints (Private Link) must be deployed for both Azure SQL Database and Azure Key Vault.
Private Endpoints secure the services by bringing them into the virtual network via private IP addresses, fulfilling the network isolation and security requirements.
2
Determine the DNS configuration required for the services to resolve to their private endpoints.
Identify that privatelink.database.windows.net and privatelink.vaultcore.azure.net private DNS zones must be created and linked to the virtual network.
Without these specific private DNS zones linked to the VNet, the virtual machines would resolve the public IP addresses of the services instead of their private IP addresses, failing name resolution requirements.
3
Evaluate alternative methods to ensure they do not introduce unnecessary administrative overhead or break system routes.
Reject manual IP routing and custom route tables (UDRs) that override system routes, as well as manually maintaining lists of IP addresses in NSG rules.
Custom routes can conflict with system routes automatically created for private endpoints, and manual IP rules in NSGs fail to keep traffic secure and introduce excessive administrative overhead.

Key Concept

Private Endpoints and Private DNS Zone Integration
Question 277Question →

An enterprise is designing a routing architecture in Azure. The topology consists of the following components:

* A hub virtual network named `vnet-hub-eus` (10.100.0.0/1610.100.0.0/16) that hosts a security Network Virtual Appliance (NVA) at 10.100.1.410.100.1.4.
* A spoke virtual network named `vnet-prod-eus` (10.110.0.0/1610.110.0.0/16) containing two subnets: `subnet-app` (10.110.1.0/2410.110.1.0/24) and `subnet-db` (10.110.2.0/2410.110.2.0/24).
* Virtual network peering is established between `vnet-hub-eus` and `vnet-prod-eus` with gateway transit disabled.

The design requires that all traffic from `vnet-prod-eus` to the Internet is routed through the NVA in `vnet-hub-eus` for inspection. However, to minimize latency and costs, traffic between `subnet-app` and `subnet-db` must route directly within the virtual network, bypassing the NVA.

To implement this, an administrator plans to associate a route table with both `subnet-app` and `subnet-db`.

Which route configuration should the administrator define in the route table to satisfy the requirements?

Show answer & explanation

Answer: A single route with the address prefix 0.0.0.0/00.0.0.0/0 and the next hop type set to Virtual appliance pointing to 10.100.1.410.100.1.4

Answer

A single route with the address prefix 0.0.0.0/00.0.0.0/0 and the next hop type set to Virtual appliance pointing to 10.100.1.410.100.1.4
The correct configuration is to define a single route with the address prefix 0.0.0.0/00.0.0.0/0 and the next hop type set to Virtual appliance pointing to the NVA's IP address. By default, Azure automatically creates system routes for all subnets in a virtual network. The system route for the local virtual network has the prefix 10.110.0.0/1610.110.0.0/16 with the next hop type set to Virtual network. Under Azure's longest prefix match (LPM) algorithm, any traffic destined for another subnet within the same virtual network (such as from `subnet-app` to `subnet-db`) matches the more specific system route (10.110.0.0/1610.110.0.0/16) rather than the default route (0.0.0.0/00.0.0.0/0). Therefore, intra-VNet traffic bypasses the NVA and is routed directly, while all internet-bound traffic (0.0.0.0/00.0.0.0/0) is routed to the NVA.

Step-by-Step Solution

1
Analyze default system routes in Azure Virtual Networks.
Azure automatically creates a system route for the virtual network prefix (10.110.0.0/1610.110.0.0/16) with the next hop set to Virtual network. This route directs traffic between all subnets in the VNet.
Understanding default system routes is necessary to determine how custom routes will interact with standard intra-VNet traffic.
2
Apply the Longest Prefix Match (LPM) rule.
When a packet is routed, Azure compares the destination IP to all routes in the route table and chooses the route with the longest (most specific) prefix match.
LPM determines which route wins when multiple routes overlap, such as a default route (0.0.0.0/00.0.0.0/0) and a local VNet prefix (10.110.0.0/1610.110.0.0/16).
3
Evaluate the custom default route configuration.
Adding a UDR for 0.0.0.0/00.0.0.0/0 pointing to the NVA handles all external/internet traffic. Because the local VNet prefix (10.110.0.0/1610.110.0.0/16) is more specific than 0.0.0.0/00.0.0.0/0, traffic between the subnets continues to use the system route directly without routing through the NVA.
This satisfies both requirements: internet traffic is inspected by the NVA, while intra-VNet traffic bypasses the NVA without needing redundant rules.

Key Concept

Azure Route Selection and Longest Prefix Match (LPM)
Question 278Question →

An organization plans to migrate an on-premises payroll application hosted on VMware vSphere. The application comprises three web servers and a backend database server running SQL Server 2016. The database uses SQL Server Agent for scheduled maintenance and performs cross-database queries. Users authenticate via an on-premises Active Directory Domain Services (AD DS) domain. The application interacts with external services, but the specific network connections are undocumented.

You need to design a migration assessment and transition strategy that meets the following requirements:
- Identify all application network dependencies before migration to prevent service disruptions.
- Minimize administrative overhead and infrastructure complexity for both the database tier and identity synchronization.
- Maintain support for the legacy database features.

Which migration strategy should you recommend?

Show answer & explanation

Answer: Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).

Answer

Perform agentless dependency analysis using Azure Migrate; migrate the database to Azure SQL Managed Instance; and implement Microsoft Entra Connect with Password Hash Synchronization (PHS).
The correct strategy uses agentless dependency analysis to map undocumented connections prior to migration. It deploys Azure SQL Managed Instance to preserve legacy features like SQL Server Agent and cross-database queries. It also configures Password Hash Synchronization (PHS) to keep the identity model simple and low-overhead.

Step-by-Step Solution

1
Determine dependency assessment requirements.
Since the network connections to external services are undocumented, performing dependency analysis is required to prevent post-migration connection failures.
This satisfies the requirement to identify all application dependencies before migration.
2
Evaluate the database tier compatible with SQL Server Agent and cross-database queries.
Azure SQL Managed Instance is chosen because it offers near-complete compatibility with SQL Server, supporting SQL Server Agent and cross-database queries natively.
Azure SQL Database single database does not support these features natively.
3
Evaluate hybrid identity options based on administrative and infrastructure overhead.
Password Hash Synchronization (PHS) is selected as it meets the synchronization requirement while requiring the least on-premises infrastructure and administrative effort.
Active Directory Federation Services (AD FS) requires deploying and maintaining federation servers and web application proxies, increasing complexity without a stated business justification.

Key Concept

Selecting target service tiers and assessment methods based on dependency requirements, database compatibility, and overhead constraints.
Question 279Question →

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-weur` (10.100.0.0/1610.100.0.0/16), hosts an Azure Firewall at 10.100.1.410.100.1.4 and an ExpressRoute gateway. The spoke virtual network, `vnet-prod-weur` (10.101.0.0/1610.101.0.0/16), contains a subnet named `subnet-app` (10.101.1.0/2410.101.1.0/24). The on-premises network uses the IP address space 172.16.0.0/12172.16.0.0/12.

The routing design must meet the following requirements:
1. All internet-bound traffic from `subnet-app` must be routed through the Azure Firewall in the hub.
2. All traffic from `subnet-app` destined for the on-premises network must be routed through the ExpressRoute gateway.
3. Local traffic within `vnet-prod-weur` must bypass the Azure Firewall.

Which two configurations should you recommend to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Configure the virtual network peering connection to allow gateway transit on `vnet-hub-weur` and use the remote virtual network's gateway on `vnet-prod-weur`.; In the route table associated with `subnet-app`, add a route for `0.0.0.0/0` with the next hop type set to Virtual appliance and the next hop address set to 10.100.1.410.100.1.4.

Answer

Configure the virtual network peering connection to allow gateway transit on the hub VNet and use the remote gateway on the spoke VNet, and add a user-defined route for the default route pointing to the Azure Firewall IP in the subnet's route table.
To route internet-bound traffic through the firewall, a route for the default route is required in the route table associated with the subnet. Azure's Longest Prefix Match ensures that the local virtual network route takes precedence over the default route, keeping local traffic local and bypassing the firewall. To connect to the on-premises network via the hub's gateway, gateway transit must be configured on the peering relationship, which makes the gateway route inheritable by the spoke.

Step-by-Step Solution

1
Configure gateway transit on the virtual network peering.
Allows the spoke VNet to access the ExpressRoute gateway in the hub VNet.
By default, virtual network peering is non-transitive. Enabling gateway transit allows resources in the spoke VNet to route traffic through the hub's gateway to on-premises networks.
2
Define the default route in the user-defined route table.
Traffic destined for the internet is sent to the Azure Firewall private IP.
A user-defined route for the default route overrides the default system route for internet traffic, sending it to the firewall for inspection.
3
Rely on system routes and Longest Prefix Match (LPM) for local traffic.
Local traffic within the spoke VNet bypasses the firewall.
Since the local VNet prefix is more specific than the default route, the system route for local traffic remains active and ensures local communication does not route to the firewall.

Key Concept

Hub-and-spoke routing with gateway transit and default route redirection using User-Defined Routes.
Question 280Question →

A company is designing the compute infrastructure on Azure for a legacy background processing application. The application has the following characteristics and requirements:
- It processes long-running batch jobs that take up to 45 minutes to complete.
- It must run continuously 24/7 and cannot tolerate unexpected interruptions or evictions.
- The solution must be highly available and resilient to datacenter outages within an Azure region.

Which compute solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Azure Virtual Machines deployed in a Virtual Machine Scale Set across multiple availability zones

Answer

Azure Virtual Machines deployed in a Virtual Machine Scale Set across multiple availability zones
The correct solution uses standard Azure Virtual Machines deployed across multiple availability zones. This provides persistent compute hosting that allows the 45-minute batch jobs to run without execution timeout restrictions, guarantees that the VMs will not be evicted, and ensures resilience against localized datacenter failures.

Step-by-Step Solution

1
Evaluate execution time requirements
Since the batch jobs require 45 minutes to complete, serverless compute options with short execution timeouts (such as Azure Functions on a Consumption plan, which limits execution to 10 minutes) must be ruled out in favor of full virtual machines that support unrestricted execution runtimes.
To ensure long-running processes can complete successfully without system-imposed timeouts.
2
Evaluate workload stability and eviction tolerance
Since the workload is a critical 24/7 production process that cannot tolerate unexpected interruptions or evictions, Spot VMs are ruled out because they are subject to sudden eviction based on capacity demands.
To satisfy the requirement that the application must run continuously without eviction.
3
Evaluate high availability and zone-resilience requirements
To protect against datacenter outages within an Azure region, the virtual machines must be distributed across multiple availability zones. Standard availability sets only protect against hardware or power failures within a single zone.
To meet the resilience requirement against localized datacenter outages.

Key Concept

Selecting appropriate Azure compute virtualization and deployment topologies based on availability, runtime, and stability constraints.
Estimated Time:1m 30s
PreviousPage 14 / 18Next
Design Infrastructure Solutions Practice Questions — Microsoft Azure Solutions Architect (AZ-305) — Page 14 | Examkin