Examkin

Design Infrastructure Solutions

360 questions

All types360Multiple choice189Multiple select171
Question 321Question →

A company plans to migrate a line-of-business (LOB) application from an on-premises Hyper-V environment to Azure. The application consists of three web servers running on Windows Server virtual machines and a database backend running on SQL Server 2022. The database backend requires SQL Server Agent jobs to schedule nightly maintenance and cross-database queries to pull data from a separate legacy HR database. The on-premises environment uses Active Directory Domain Services (AD DS) for authentication. The hybrid identity solution only requires user authentication without federated authentication. You need to design the migration assessment and target architecture while minimizing administrative overhead, complexity, and the risk of service disruption. Which two actions should you recommend? (Choose two)

Select all that apply

Show answer & explanation

Answer: Configure Azure Migrate to perform dependency analysis for the on-premises virtual machines.; Target Azure SQL Managed Instance for the database backend migration.

Answer

To successfully migrate the workload while meeting all technical requirements and minimizing overhead, you must configure Azure Migrate to perform dependency analysis for the on-premises virtual machines and target Azure SQL Managed Instance for the database backend.
The correct recommendations are to configure Azure Migrate to perform dependency analysis for the on-premises virtual machines and to target Azure SQL Managed Instance for the database backend. Dependency analysis is critical to map out network communication dependencies between servers, ensuring that the migration does not break connections to other on-premises systems like the legacy HR database. Azure SQL Managed Instance is the most appropriate database tier because it supports required legacy SQL Server features, such as SQL Server Agent and cross-database queries, while providing a fully managed service that minimizes administrative overhead.

Step-by-Step Solution

1
Analyze database requirements.
Identify the need for SQL Server Agent and cross-database queries.
These requirements eliminate Azure SQL Database (single database) from consideration since it does not support these features.
2
Analyze identity and migration dependency requirements.
Identify the need to map connections to the legacy HR database and establish simple user authentication.
A dependency analysis is required to prevent broken connections, and Active Directory Federation Services (AD FS) should be avoided to prevent unnecessary complexity since federation is not required.
3
Select the migration tools and target tiers.
Select Azure SQL Managed Instance for the database and Azure Migrate dependency analysis for the virtual machines.
Azure SQL Managed Instance provides the necessary SQL Server compatibility with managed service benefits, and Azure Migrate dependency analysis ensures all service connections are discovered.

Key Concept

Selecting appropriate database migration targets and planning dependency assessments to ensure application compatibility and connectivity during Azure migrations.
Question 322Question →

A logistics company is designing the compute infrastructure for a new real-time fleet tracking application. The application consists of a stateless API layer that runs continuously 24/7. The API layer requires a 99.99% availability SLA and must be deployed across multiple Availability Zones to ensure resiliency. The workload is highly predictable with a steady-state CPU and memory usage profile. The company wants to minimize compute costs over a three-year period without risking service interruption.

Which compute solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Deploy the API layer on standard Azure Virtual Machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones.

Answer

Deploy the API layer on standard Azure Virtual Machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones.
Deploying standard virtual machines configured with three-year Azure Reserved Virtual Machine Instances across multiple Availability Zones is correct. Reserved instances provide significant cost savings (up to 72% compared to pay-as-you-go) for predictable, steady-state workloads with a long-term commitment. Deploying across multiple zones meets the 99.99% availability SLA without the risk of eviction.

Step-by-Step Solution

1
Analyze the SLA and availability requirements.
The application requires a 99.99% VM availability SLA and must be deployed across multiple Availability Zones to ensure resiliency.
This rules out single-zone deployments which do not meet the 99.99% VM availability SLA criteria.
2
Analyze the workload profile and tolerance for interruption.
The workload is a continuous, 24/7 steady-state API that cannot tolerate service interruptions.
This rules out Spot VMs and Spot-priority Virtual Machine Scale Sets, as they can be evicted at any time without warning.
3
Evaluate the cost optimization options for a three-year horizon.
Azure Reserved Virtual Machine Instances with a three-year commitment match the steady-state nature of the workload and maximize savings.
Reserved Instances offer up to 72% savings compared to pay-as-you-go pricing for predictable, long-running virtual machine workloads.

Key Concept

Selecting Azure VM purchasing models and resiliency configurations based on SLA, cost constraints, and workload predictability.
Question 323Question →

An organization is planning to migrate a legacy enterprise resource planning (ERP) application from on-premises physical servers to Azure Virtual Machines. The application's components communicate over several undocumented TCP ports, and the network communication dependencies between the servers must be fully mapped to prevent application downtime during the transition. Which configuration should you recommend to identify the server dependencies?

Show answer & explanation

Answer: Deploy the Azure Migrate appliance and install the Dependency agent and the Log Analytics agent on each physical server.

Answer

Deploy the Azure Migrate appliance and install the Dependency agent and the Log Analytics agent on each physical server.
The correct configuration is to deploy the Azure Migrate appliance and install the Dependency agent and the Log Analytics agent on each physical server. Because agentless dependency analysis is not supported for physical servers, agent-based discovery using these agents is required to identify network dependencies and open ports.

Step-by-Step Solution

1
Identify the source environment and requirements.
The workloads are hosted on physical servers, and we need to map network communication dependencies.
Physical servers have different dependency mapping support compared to virtualized environments like VMware or Hyper-V.
2
Determine the supported dependency mapping mechanism.
Azure Migrate supports agentless dependency mapping only for VMware and Hyper-V virtual machines. For physical servers, agent-based dependency mapping is required.
Agent-based dependency mapping requires installing the Dependency agent and the Log Analytics agent on each server to capture network dependencies.
3
Select the correct migration assessment configuration.
Deploy the Azure Migrate appliance and install the required agents on the physical servers.
This configuration correctly maps the network dependencies of physical servers.

Key Concept

Azure Migrate dependency mapping for physical servers

Alternative Method

Instead of agent-based dependency mapping, if the workloads were running on VMware vSphere rather than physical servers, you could perform agentless dependency mapping via the Azure Migrate appliance using VM credentials.
Estimated Time:2m 0s
Question 324Question →

An online multiplayer gaming platform is designing the compute infrastructure on Azure. The architecture must support two workloads:

WorkloadTypeScaling RequirementEviction ToleranceCPU-to-Memory Ratio
Workload 1 (Session Hosting)StatelessDynamic scalingCan tolerate unexpected evictionsAt least 1:41:4 (e.g., ≥4 GB\ge 4\text{ GB} per vCPU)
Workload 2 (Matchmaking Engine)StatefulSteady-stateCannot tolerate unexpected evictionsAt least 1:81:8 (e.g., ≥8 GB\ge 8\text{ GB} per vCPU)

Which two configuration options should you select to meet these requirements?

Select all that apply

Show answer & explanation

Answer: For Workload 1, deploy a Virtual Machine Scale Set using Azure Spot VMs with a Dsv5-series VM size.; For Workload 2, deploy Azure Virtual Machines using an Esv5-series VM size.

Answer

Deploy a Virtual Machine Scale Set using Azure Spot VMs with a Dsv5-series size for Workload 1, and deploy Azure Virtual Machines using an Esv5-series size for Workload 2.
Deploying the session hosting layer on a Virtual Machine Scale Set using Azure Spot VMs of the Dsv5-series meets the requirements of cost savings, eviction tolerance, and the 1:41:4 CPU-to-memory ratio. Deploying the matchmaking database on standard Azure Virtual Machines of the Esv5-series satisfies the steady-state SLA requirement (no unexpected evictions) and the 1:81:8 memory-optimized ratio.

Step-by-Step Solution

1
Analyze the requirements for Workload 1 (Session Hosting).
Workload 1 requires dynamic scaling, can tolerate unexpected evictions to minimize cost, and needs a 1:41:4 vCPU-to-memory ratio.
This points to using Azure Spot VMs within a Virtual Machine Scale Set, utilizing a Dsv5-series VM size which matches the memory-to-vCPU ratio.
2
Analyze the requirements for Workload 2 (Matchmaking Engine).
Workload 2 requires steady-state execution (no unexpected evictions), and needs a 1:81:8 vCPU-to-memory ratio.
This rules out Spot VMs (which can be evicted) and points to standard Azure Virtual Machines using a memory-optimized VM series like Esv5.
3
Evaluate the architectural high availability option.
The option suggesting the use of Availability Sets within a single zone for zone redundancy is incorrect.
Availability Sets only protect against localized hardware failures within a single zone and do not provide cross-zone redundancy.

Key Concept

Selecting VM sizes based on memory-to-CPU ratios, and choosing between standard VMs and Spot VMs based on workload eviction tolerance and SLA constraints.
Question 325Question →

You are designing a migration strategy to Azure for an on-premises application that runs on five physical servers hosting a custom web portal and an Oracle database. You need to use Azure Migrate to evaluate the workloads, discover dependencies, and recommend appropriate Azure target resources. Which two actions should you include in the migration assessment design? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Deploy the Azure Migrate appliance in the on-premises environment to discover metadata and performance data from the physical servers.; Configure credentials on the Azure Migrate appliance to allow agentless discovery of dependencies and software inventory on the physical servers.

Answer

To design the migration assessment, you must deploy the Azure Migrate appliance on-premises to discover server metadata and configure server credentials on the appliance to perform agentless dependency analysis.
The correct actions focus on establishing the primary discovery mechanism and gathering communication patterns. Deploying the Azure Migrate appliance allows discovery of metadata and performance data. Configuring the correct credentials on the appliance is mandatory for executing commands that retrieve connection data, allowing agentless dependency analysis.

Step-by-Step Solution

1
Plan the deployment of the Azure Migrate appliance.
The appliance is set up on-premises, enabling the collection of performance metadata and software inventory from the physical servers.
Discovery of server metadata is required to evaluate Azure readiness and calculate estimated cloud sizing and costs.
2
Configure the necessary credentials on the Azure Migrate appliance for target physical servers.
The appliance receives permissions to query connection tables and running processes on the physical servers.
This allows agentless dependency mapping, allowing you to identify which servers communicate with each other so you can plan migration waves.

Key Concept

Migration Assessment and Dependency Discovery for Physical Servers
Estimated Time:2m 0s
Question 326Question →

A retail company is modernizing a regional store-management application in the West Europe region. The application requires SSL/TLS termination and URL-based routing to direct web traffic to different backend pools. In addition, a legacy inventory sync service running on TCP port 9000 must be load balanced across a database replication virtual machine (VM) pool. The database replication VMs currently have Basic SKU public IP addresses assigned to their network interfaces. The proposed design uses an Azure Application Gateway for the web traffic and an Azure Standard Load Balancer for the inventory sync service. Which action should you recommend to ensure the load balancing configuration for the database replication tier is valid?

Show answer & explanation

Answer: Upgrade the public IP addresses of the database replication VMs to the Standard SKU.

Answer

Upgrade the public IP addresses of the database replication VMs to the Standard SKU.
The correct action is to upgrade the public IP addresses of the database replication VMs to the Standard SKU. Azure Standard Load Balancer enforces a strict rule that all associated backend resources that have public IP addresses must use the Standard SKU. If there is a mix of Basic SKU public IPs and a Standard Load Balancer, the deployment will fail validation.

Step-by-Step Solution

1
Identify the load balancer SKU requirements for backend virtual machines.
Azure Standard Load Balancer requires all attached network interfaces with public IP addresses to use the Standard SKU.
This is a fundamental platform limitation to ensure security and predictability of Standard SKU resources.
2
Identify the current SKU of the database replication VMs' public IPs.
The database replication VMs are currently assigned Basic SKU public IP addresses.
We must identify the source of the incompatibility to resolve the configuration failure.
3
Select the appropriate remediation step.
Recommend upgrading the public IP addresses of the database replication VMs from Basic SKU to Standard SKU.
Upgrading the public IPs to Standard SKU aligns them with the Standard Load Balancer's requirements and allows successful deployment.

Key Concept

Standard SKU public IP requirements for Azure Standard Load Balancer backend pools
Question 327Question →

A media broadcasting company is designing a system on Azure to process weekly high-definition video archives. The processing jobs are batch-oriented, can be interrupted and resumed without loss of progress, and must be completed within a flexible 48-hour window to minimize costs. Conversely, the system's management dashboard is a steady-state web application that must remain highly available 24/7 with no tolerance for unexpected downtime.

Which compute configuration should you recommend to meet these requirements while minimizing costs?

Show answer & explanation

Answer: Host the video processing jobs on Azure Spot Virtual Machines, and host the management dashboard on standard Azure Virtual Machines.

Answer

Host the video processing jobs on Azure Spot Virtual Machines, and host the management dashboard on standard Azure Virtual Machines.
The correct recommendation is to host the video processing jobs on Azure Spot Virtual Machines and the management dashboard on standard Azure Virtual Machines. Spot VMs are highly cost-effective and suitable for batch jobs that can tolerate interruptions and be resumed. In contrast, the management dashboard is a steady-state application that requires continuous availability and cannot tolerate evictions, thus requiring standard Azure Virtual Machines.

Step-by-Step Solution

1
Analyze the requirements for the video processing workload.
The video processing jobs are batch-oriented, interruptible, and have a flexible completion window of 48 hours, making them ideal candidates for Azure Spot Virtual Machines to reduce costs.
Spot VMs provide unused Azure capacity at a deep discount, but can be evicted with a 30-second warning, which is acceptable for workloads that can be paused and resumed.
2
Analyze the requirements for the management dashboard workload.
The management dashboard is a steady-state web application that requires 24/7 high availability with no tolerance for unexpected downtime, meaning it must be hosted on standard Azure Virtual Machines.
Standard Azure Virtual Machines offer SLA-backed availability and are not subject to capacity-based evictions.
3
Select the option that matches both compute requirements while minimizing costs.
Host the video processing jobs on Azure Spot VMs and the management dashboard on standard Azure VMs.
This combination leverages cost-saving Spot instances for the tolerant batch workload while protecting the critical production dashboard from eviction.

Key Concept

Selecting appropriate virtual machine types and pricing models (Spot vs. Standard) based on workload stability, tolerance for interruption, and cost requirements.
Question 328Question →

An enterprise is modernizing a regional HR portal deployed on Azure Virtual Machines. The architecture must satisfy the following requirements:
- Load balance inbound HTTP/S traffic with SSL/TLS termination and URL-path-based routing.
- Allow backend VMs to receive traffic from the Layer 7 load balancer and use a separate Layer 4 load balancer for outbound internet access.
- Avoid configuration conflicts related to Public IP and Load Balancer SKU mismatches.

Which two actions should you perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy Azure Application Gateway (Standard v2 SKU) to handle inbound SSL/TLS termination and URL-path-based routing.; Configure an Azure Standard Load Balancer for outbound connectivity and ensure all public IP addresses associated with the backend virtual machines are of the Standard SKU.

Answer

To meet the requirements, you must deploy Azure Application Gateway (Standard v2 SKU) to handle inbound SSL/TLS termination and URL-path-based routing, and configure an Azure Standard Load Balancer for outbound connectivity ensuring all associated public IP addresses use the Standard SKU.
The correct architecture uses Azure Application Gateway for regional Layer 7 load balancing (providing SSL/TLS termination and path-based routing) and an Azure Standard Load Balancer for Layer 4 outbound connectivity. Because the load balancer and public IPs must have matching SKUs, deploying a Standard Load Balancer requires using Standard SKU public IP addresses on the backend virtual machines.

Step-by-Step Solution

1
Evaluate the inbound Layer 7 load balancing requirements.
Identify that SSL/TLS termination and URL-path-based routing are Layer 7 features, which requires Azure Application Gateway rather than a Layer 4 Load Balancer or DNS-based Traffic Manager.
Azure Application Gateway is the regional application delivery controller that operates at Layer 7.
2
Address the outbound Layer 4 load balancing and public IP SKU compatibility.
Determine that an Azure Standard Load Balancer should be used for outbound traffic and that all public IPs associated with the backend VMs must match this SKU.
Azure enforces strict SKU matching, meaning Basic and Standard SKUs cannot be mixed within the same virtual machine network interfaces and load balancers.

Key Concept

Azure load balancer SKU matching and Layer 7 application routing rules.
Question 329Question →

An organization plans to migrate a line-of-business (LOB) application running on VMware vSphere to Azure. The application consists of three web servers and a backend SQL Server database that executes cross-database queries. The network connections and dependencies between the web servers and other internal systems are undocumented.

You need to design a migration assessment and target architecture strategy that:
- Minimizes the risk of broken application dependencies during the migration waves.
- Supports the database's cross-database query requirements.

Which strategy should you recommend?

Show answer & explanation

Answer: Enable agentless dependency analysis using the Azure Migrate appliance to group dependent servers, and recommend Azure SQL Managed Instance as the database migration target.

Answer

Enable agentless dependency analysis using the Azure Migrate appliance to group dependent servers, and recommend Azure SQL Managed Instance as the database migration target.
The correct strategy uses agentless dependency analysis via the Azure Migrate appliance to discover and map network connections between servers, ensuring they are grouped into the same migration waves to prevent service disruption. Furthermore, Azure SQL Managed Instance is recommended because it supports SQL Server features such as cross-database queries, which are not supported in Azure SQL Database single database or elastic pools.

Step-by-Step Solution

1
Determine the database tier target that satisfies technical features.
Recommending Azure SQL Managed Instance supports the cross-database queries required by the source SQL Server database.
Azure SQL Database single databases and elastic pools do not support cross-database queries, which would break the application.
2
Analyze how to safely group undocumented VM dependencies for migration.
Recommending agentless dependency analysis via the Azure Migrate appliance allows mapping of active TCP connections.
Failing to analyze network dependencies leads to broken applications and high latency when interconnected VMs are migrated in separate waves.
3
Consolidate both requirements into a single migration strategy.
Recommend using the Azure Migrate appliance for agentless dependency analysis for grouping and Azure SQL Managed Instance for the database target.
This strategy satisfies all technical and dependency constraints.

Key Concept

Determining migration wave dependencies and choosing database target options with legacy compatibility.
Question 330Question →

An enterprise is deploying a regional web application in the North Europe region. The backend pool consists of Azure Virtual Machines that require outbound internet connectivity via Standard SKU Public IP addresses. The application requirements are as follows:
- Route incoming HTTPS traffic based on URL path rules (e.g., routing `/orders/*` to a specific backend pool).
- Offload SSL/TLS decryption to the load balancer to reduce CPU load on the backend web servers.
- Keep all load balancing and traffic routing strictly within the local region to comply with data sovereignty regulations.
- Ensure compatibility between the load balancer SKU and the Standard SKU public IP configurations of the virtual machines.

Which load balancing solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Azure Application Gateway (Standard v2)

Answer

Azure Application Gateway (Standard v2)
Azure Application Gateway (Standard v2) is the correct choice because it is a regional Layer 7 load balancer that supports URL path-based routing and SSL/TLS termination, and its Standard SKU is fully compatible with the Standard SKU Public IP configurations on the backend virtual machines.

Step-by-Step Solution

1
Analyze protocol and routing requirements
The application requires Layer 7 features: HTTPS protocol support, SSL/TLS termination, and URL path-based routing (`/orders/*`). This eliminates Layer 4 load balancers (such as Azure Load Balancer) and DNS-based routing (such as Azure Traffic Manager) from being the primary solution for these requirements.
Layer 4 balancers only route traffic based on IP address and port, whereas Layer 7 gateways can inspect the HTTP/HTTPS request headers and paths.
2
Analyze geographic scope and data residency requirements
The solution must keep traffic routing strictly within the local region (North Europe) to comply with data sovereignty regulations. This rules out global services like Azure Front Door.
Azure Front Door is a global service that routes traffic across Microsoft's global edge network, which does not align with strict local regional routing requirements.
3
Evaluate SKU compatibility constraints
The backend virtual machines are configured with Standard SKU Public IP addresses. To prevent validation errors, the load balancer/gateway must support Standard SKU public IP configurations.
Azure resources require matching SKUs; mixing Basic SKU load balancers or gateways with Standard SKU public IP addresses on backend virtual machines causes deployment and connectivity failures.

Key Concept

Azure Application Gateway Standard v2 provides regional Layer 7 load balancing, SSL offloading, path-based routing, and compatibility with Standard SKU virtual network resources.
Estimated Time:1m 30s
Question 331Question →

A retail company plans to migrate its legacy inventory management system from an on-premises datacenter to Azure. The system has the following components and requirements:

* Two database servers running SQL Server 2016 on physical hardware. The databases utilize SQL Server Agent jobs for nightly synchronization and perform cross-database queries.
* Four web servers running IIS on VMware ESXi virtual machines.
* An on-premises Active Directory Domain Services (AD DS) domain. The company wants to synchronize user identities to Microsoft Entra ID with minimal infrastructure overhead, and does not require federated authentication.

You need to design a migration assessment and target architecture strategy.

Which two actions should you include in the recommendation? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Recommend Azure SQL Managed Instance as the target migration tier for the SQL Server databases.; Configure agentless dependency analysis in Azure Migrate for the VMware ESXi virtual machines.

Answer

Recommend Azure SQL Managed Instance as the target migration tier for the SQL Server databases, and configure agentless dependency analysis in Azure Migrate for the VMware ESXi virtual machines.
The correct recommendation includes choosing Azure SQL Managed Instance as the database target tier because it supports instance-level features like SQL Server Agent and cross-database queries, which are required by the legacy workload. Additionally, configuring agentless dependency analysis using Azure Migrate for the VMware ESXi VMs ensures that application network connections are mapped properly before migration without requiring agent installation overhead.

Step-by-Step Solution

1
Analyze the database requirements to determine the target tier.
The databases require SQL Server Agent and cross-database queries. Azure SQL Database single database does not support these, so Azure SQL Managed Instance must be selected.
Ensures application compatibility and minimizes code changes during migration.
2
Select the appropriate dependency mapping strategy.
Use Azure Migrate with agentless dependency analysis for the VMware ESXi web servers to identify application dependencies.
Allows mapping of server connections without operational overhead of installing agents, preventing broken links during migration.
3
Determine the identity synchronization mechanism.
Microsoft Entra Connect with Password Hash Synchronization (PHS) is sufficient, avoiding AD FS due to the requirement for minimal infrastructure overhead.
Meets the business constraint of lowest operational and infrastructure overhead.

Key Concept

Selecting target Azure relational database tiers based on feature compatibility (SQL Agent, cross-database queries) and planning migration dependencies with Azure Migrate.
Question 332Question →

An organization is planning to migrate a legacy enterprise resource planning (ERP) application from an on-premises Hyper-V environment to Azure. The application consists of three web servers and two SQL Server database servers. The database tier relies on SQL Server Agent jobs and performs cross-database queries. The network connection dependencies between the web servers and external payment gateways are not documented. The organization wants to synchronize their on-premises Active Directory to Microsoft Entra ID with single sign-on (SSO) while minimizing administrative and infrastructure overhead.

Which assessment strategy and target architecture should you recommend?

Show answer & explanation

Answer: Perform agentless dependency analysis using Azure Migrate, use Microsoft Entra Connect with Password Hash Synchronization (PHS) for identity, and migrate the databases to Azure SQL Managed Instance.

Answer

Perform agentless dependency analysis using Azure Migrate, use Microsoft Entra Connect with Password Hash Synchronization (PHS) for identity, and migrate the databases to Azure SQL Managed Instance.
The correct strategy utilizes Azure Migrate agentless dependency analysis to discover undocumented external connections, minimizing the risk of post-migration communication issues. Using Azure SQL Managed Instance preserves legacy SQL Server features like SQL Server Agent and cross-database queries with minimal refactoring. Finally, Microsoft Entra Connect with Password Hash Synchronization (PHS) satisfies the single sign-on requirement with the lowest possible administrative and infrastructure footprint.

Step-by-Step Solution

1
Analyze application requirements and technical constraints.
Identify the need for SQL Server Agent, cross-database queries, and undocumented network dependency discovery.
Ensures the selected target architecture supports all application dependencies.
2
Evaluate the migration assessment tool strategy.
Recommend Azure Migrate agentless dependency analysis.
Allows automatic discovery of connections between web servers and external payment gateways without installing agents on every virtual machine.
3
Select the target database platform and identity synchronization method.
Recommend Azure SQL Managed Instance and Microsoft Entra Connect with Password Hash Synchronization (PHS).
Managed Instance supports legacy SQL Server features, while PHS provides SSO with minimal administrative overhead.

Key Concept

Selecting target migration services and assessment strategies based on application features, database dependencies, and organizational constraints.
Estimated Time:2m 0s
Question 333Question →

An organization is deploying a high-throughput, non-HTTP TCP-based telemetry application on Azure Virtual Machines in a single region. The virtual machines require direct inbound internet access and are configured with Standard SKU public IP addresses on their network interfaces. You need to design a load balancing solution to distribute incoming TCP traffic across the virtual machines. The design must minimize complexity and avoid validation errors during deployment. Which two configuration components should you include in the load balancing design?

Select all that apply

Show answer & explanation

Answer: A Standard SKU Azure Load Balancer; A Standard SKU public IP address for the load balancer's frontend IP configuration

Answer

The design must include a Standard SKU Azure Load Balancer and a Standard SKU public IP address for the load balancer's frontend IP configuration.
The correct configurations are a Standard SKU Azure Load Balancer and a Standard SKU public IP address for the frontend. Since the backend Virtual Machines are already configured with Standard SKU public IP addresses, the Azure Load Balancer must also be a Standard SKU to prevent SKU mismatch errors. Furthermore, a Standard SKU Azure Load Balancer requires its frontend IP configuration to use a Standard SKU public IP address.

Step-by-Step Solution

1
Analyze the virtual machine configuration and application protocol.
The virtual machines are configured with Standard SKU public IP addresses and run a non-HTTP TCP application.
This establishes the protocol (TCP requires Azure Load Balancer rather than Application Gateway/Front Door) and the SKU boundary (Standard SKU IP).
2
Determine the load balancer SKU required for the backend pool.
A Standard SKU Azure Load Balancer must be selected.
Basic SKU load balancers cannot connect to backend virtual machines that are configured with Standard SKU public IP addresses.
3
Select the frontend public IP configuration SKU for the load balancer.
A Standard SKU public IP address is required.
Standard SKU Load Balancers require Standard SKU frontend public IPs; mixing Basic and Standard SKUs in this configuration causes validation failures.

Key Concept

Azure Load Balancer SKU compatibility and resource constraints when mixing Basic and Standard SKUs.
Question 334Question →

A logistics company plans to migrate its custom order dispatch system to Azure. The system runs on several physical Windows and Linux servers. The database runs on a Microsoft SQL Server instance that requires cross-database queries and utilizes SQL Server Agent jobs. The company wants to implement a hybrid identity model for users to access the migrated system using their on-premises credentials. Security policies require that authentication credentials must be validated on-premises without deploying any federated identity infrastructure.

You need to recommend the components and targets for the migration assessment and strategy.

Which two recommendations should you include? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Migrate the database to Azure SQL Managed Instance; Configure Microsoft Entra Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO)

Answer

Migrate the database to Azure SQL Managed Instance and configure Microsoft Entra Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO).
The correct recommendations are to migrate the database to Azure SQL Managed Instance and configure Microsoft Entra Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO). Azure SQL Managed Instance supports instance-scoped features such as cross-database queries and SQL Server Agent, which are necessary for this workload. Pass-through Authentication meets the requirement to validate credentials against the on-premises Active Directory without the administrative overhead and complexity of federated identity infrastructure.

Step-by-Step Solution

1
Analyze the database requirements for SQL Server Agent and cross-database queries.
Determine that Azure SQL Managed Instance is the appropriate destination because Azure SQL Database single databases do not support instance-scoped features.
Matching legacy SQL Server feature requirements to the correct relational database deployment option ensures application compatibility after migration.
2
Evaluate the security and identity constraints requiring on-premises credential validation without federation.
Select Microsoft Entra Pass-through Authentication (PTA) with Seamless SSO.
PTA validates passwords directly against the on-premises Active Directory using lightweight local agents, avoiding the administrative overhead of Active Directory Federation Services (AD FS).
3
Evaluate assessment tasks to ensure workload functionality.
Determine that dependency mapping is required to avoid breaking relationships between servers.
Running dependency discovery with Azure Migrate is critical for identifying active network communication and grouping related servers correctly.

Key Concept

Selecting target database tiers and hybrid identity authentication methods based on legacy dependencies and security policies.
Question 335Question →

An enterprise is designing a regional application architecture in West US 2. The solution requires hosting two distinct workloads on Azure Virtual Machines:

1. A web application backend that requires SSL/TLS termination, URL-path-based routing, and cookie-based session affinity.
2. A high-throughput legacy database backend that communicates over a custom TCP port and requires layer 4 load balancing.

The virtual machines for both workloads will be deployed across multiple Availability Zones. Currently, the legacy database virtual machines have Basic SKU Public IP addresses assigned to their network interfaces.

You need to design a load balancing solution that meets these requirements while ensuring successful deployment validation.

Which of the following actions should you perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Azure Application Gateway Standard v2 to route traffic to the web application backend.; Deploy a Standard SKU Azure Load Balancer for the legacy database backend, and either upgrade the database virtual machines' Public IP addresses to Standard SKU or remove them.

Answer

Deploy Azure Application Gateway Standard v2 to route traffic to the web application backend, and deploy a Standard SKU Azure Load Balancer for the legacy database backend while either upgrading the database virtual machines' Public IP addresses to Standard SKU or removing them.
To satisfy the layer 7 HTTP/HTTPS features (SSL/TLS termination, path-routing, session affinity) and high availability across Availability Zones, Azure Application Gateway Standard v2 is the correct choice. For the layer 4 TCP database traffic requiring Availability Zones, a Standard SKU Azure Load Balancer is needed. However, because the backend VMs currently have Basic SKU Public IP addresses, those IP addresses must be upgraded to Standard SKU or disassociated to avoid validation errors when adding the VMs to the Standard Load Balancer backend pool.

Step-by-Step Solution

1
Analyze the requirements for the web application backend.
Identify that SSL/TLS termination, URL-path-based routing, and cookie-based affinity are layer 7 HTTP/HTTPS features, which are natively supported by Azure Application Gateway Standard v2.
This determines the correct load balancer type for the first workload.
2
Analyze the requirements for the legacy database backend.
Identify that layer 4 TCP load balancing and Availability Zone support are required, which points to a Standard SKU Azure Load Balancer.
This determines the correct load balancer type for the second workload.
3
Check compatibility between the existing virtual machine configurations and the selected load balancer SKU.
Recognize that the legacy database virtual machines currently use Basic SKU Public IPs, which cannot be mixed with a Standard SKU Load Balancer.
To prevent validation failures, the Public IPs on the virtual machines' network interfaces must be upgraded to Standard SKU or disassociated.

Key Concept

Selecting the appropriate Azure load balancing services based on layer, protocol, and SKU compatibility constraints.
Question 336Question →

An organization plans to migrate an on-premises application suite to Azure. The workloads run on Hyper-V virtual machines (VMs). The application backend consists of a SQL Server instance that relies on SQL Server Agent jobs for daily maintenance tasks and requires cross-database queries. To plan the migration, you need to map network dependencies between the application and database VMs. The security team prohibits installing any new software, agents, or management utilities on the guest VMs during assessment, but they can provide local administrator credentials for guest OS analysis. Which combination of Azure SQL deployment option and Azure Migrate dependency mapping method should you recommend?

Show answer & explanation

Answer: Azure SQL Managed Instance for the database, and agentless dependency analysis using the Azure Migrate appliance.

Answer

Azure SQL Managed Instance for the database, and agentless dependency analysis using the Azure Migrate appliance.
The correct recommendation is Azure SQL Managed Instance combined with agentless dependency analysis. Azure SQL Managed Instance provides full SQL Server engine compatibility, supporting cross-database queries and SQL Server Agent jobs out of the box. For Hyper-V workloads, Azure Migrate agentless dependency mapping leverages the Azure Migrate appliance to connect to the VMs using local administrator credentials to gather dependency data without installing any management agents or software on the guest operating systems.

Step-by-Step Solution

1
Analyze the database requirements of the workload.
Identify that the database requires SQL Server Agent jobs and cross-database queries.
These features are supported in Azure SQL Managed Instance but are not supported in Azure SQL Database single database or elastic pools.
2
Analyze the security constraints and dependency mapping requirements.
Determine that dependency mapping must be executed without installing agents on the Hyper-V guest VMs.
Agentless dependency analysis using the Azure Migrate appliance uses guest OS credentials to run scripts and gather connection information, satisfying the constraint of not installing software on target VMs.
3
Combine the evaluations to select the optimal migration strategy.
Recommend Azure SQL Managed Instance combined with agentless dependency mapping.
This strategy satisfies the operational requirements of the database engine and respects the security limitations of the migration assessment phase.

Key Concept

Selecting the appropriate Azure SQL deployment option based on legacy features (SQL Server Agent and cross-database queries) and configuring agentless dependency analysis to satisfy guest VM security limitations.
Question 337Question →

An enterprise is modernizing a web application. The application requires global HTTP/S load balancing, URL-based routing, and SSL/TLS termination at the edge. Additionally, the application requires high-availability, zone-redundant Layer 4 load balancing for custom TCP traffic on port 9000 within a single region. The backend virtual machines currently use Basic SKU Public IP addresses.

You need to design a load balancing architecture that meets these requirements while avoiding validation errors during deployment.

Which two of the following components or actions should you include in the design? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Front Door to manage global HTTP/S routing and SSL/TLS termination; Upgrade the virtual machine Public IP addresses to Standard SKU and deploy a Standard Load Balancer

Answer

The correct design includes Azure Front Door for global HTTP/S routing and SSL/TLS termination, and upgrading the virtual machine Public IP addresses to Standard SKU combined with deploying a Standard Load Balancer.
The correct design uses Azure Front Door for the global HTTP/S web traffic because it supports SSL/TLS termination and URL-based routing. For the regional TCP traffic requiring zone redundancy, a Standard Load Balancer is required. To prevent validation errors, the backend virtual machines' Public IPs must be upgraded to Standard SKU to match the Load Balancer SKU.

Step-by-Step Solution

1
Identify global Layer 7 routing requirements
Azure Front Door is selected for global URL-based routing and SSL/TLS termination.
Azure Front Door operates at Layer 7 and provides global routing, SSL offloading, and path-based traffic delivery.
2
Identify regional Layer 4 routing requirements
Standard Load Balancer is selected to load balance TCP port 9000 traffic with zone-redundancy.
Standard Load Balancer supports Layer 4 TCP load balancing and is zone-redundant, whereas Basic Load Balancer does not support availability zones.
3
Ensure SKU compatibility to prevent validation errors
Upgrade the VM Public IP addresses to Standard SKU.
Mixing Basic SKU Public IPs with a Standard Load Balancer backend pool causes deployment validation errors.

Key Concept

Designing a combined global and regional load balancing solution with appropriate SKU matching.
Question 338Question →

A company is deploying a regional backend database service on Azure Virtual Machines in the East US region. The virtual machines require direct inbound internet access for management, which is currently enabled via Basic SKU public IP addresses assigned to their network interfaces. You need to design a load balancing solution using a regional Azure Standard Load Balancer to distribute custom TCP database traffic across these virtual machines. During the deployment, you encounter validation errors when configuring the backend pool. Which action should you recommend to resolve the validation errors?

Show answer & explanation

Answer: Upgrade the public IP addresses assigned to the virtual machines' network interfaces to the Standard SKU.

Answer

Upgrade the public IP addresses assigned to the virtual machines' network interfaces to the Standard SKU.
The correct action is to upgrade the public IP addresses assigned to the virtual machines to the Standard SKU. Azure Standard Load Balancers require all associated resources, including the virtual machines in the backend pool and any public IP addresses assigned directly to their network interfaces, to use the Standard SKU. Mixing Basic and Standard SKUs within the same load balancer configuration is not supported and causes deployment validation failures.

Step-by-Step Solution

1
Identify the root cause of the validation failure.
A Standard Load Balancer backend pool cannot contain virtual machines that have Basic SKU public IP addresses assigned to their network interfaces.
Azure enforces SKU alignment; all resources associated with a Standard Load Balancer (frontend IPs, backend pool members, and individual public IPs on backend VMs) must use the Standard SKU.
2
Determine the appropriate resolution.
Upgrading the public IP addresses of the backend virtual machines from Basic to Standard SKU will satisfy the validation requirements.
Standard SKU public IPs are compatible with Standard Load Balancer backend pools.

Key Concept

SKU compatibility requirements for Azure Standard Load Balancer.
Estimated Time:2m 0s
Question 339Question →

An enterprise is designing a multi-region web application deployment across the East US and West US regions. The architecture must satisfy the following requirements:
- Route incoming traffic globally to the closest healthy region with SSL/TLS termination at the global edge.
- Perform URL-path routing (e.g., directing traffic under `/api/*` to dedicated API backends).
- Use regional load balancers to distribute traffic to Azure Virtual Machines in each region.
- The virtual machines currently have Basic SKU Public IP addresses assigned to their network interfaces.

Which two actions should you perform to meet these requirements and prevent validation failures? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy Azure Front Door to manage global traffic routing and Azure Application Gateway (Standard v2) in each region.; Upgrade the Public IP addresses of the virtual machines to Standard SKU.

Answer

Deploy Azure Front Door globally along with Azure Application Gateway in each region, and upgrade the virtual machines' public IP addresses to Standard SKU.
To satisfy the global routing and edge SSL/TLS termination requirements, Azure Front Door is the appropriate service because it operates at the global edge. To handle URL-path routing regionally, Azure Application Gateway (Standard v2) must be deployed in each region. Because these regional services utilize the Standard SKU, any public IP addresses associated with the backend virtual machines' network interfaces must be upgraded to the Standard SKU to avoid validation conflicts.

Step-by-Step Solution

1
Determine the global load balancing and SSL termination mechanism.
Select Azure Front Door as the global ingress point.
Azure Front Door operates at Layer 7, providing global routing, SSL/TLS termination at the edge, and integration with regional endpoints.
2
Determine the regional path-based routing mechanism.
Select Azure Application Gateway (Standard v2) for each region.
Azure Application Gateway provides regional Layer 7 routing capabilities, including URL-path routing, to distribute traffic to specific backend pools.
3
Address SKU compatibility for the regional backend pool resources.
Identify that existing Basic SKU Public IPs on the virtual machines will cause validation errors with Standard SKU resources, and upgrade them to Standard SKU.
Standard SKU load balancing resources (such as Standard Load Balancer or Standard Application Gateway) require backend virtual machines to either have no public IPs or to have Standard SKU Public IPs.

Key Concept

Azure Application Load Balancing and SKU Validation Constraints
Question 340Question →

A manufacturing company is planning the migration of a legacy assembly-line tracking application to Azure. The application runs on several on-premises physical servers running Windows Server and Red Hat Enterprise Linux. There is no up-to-date documentation detailing the network communication or ports used between these physical servers. Additionally, the backend database runs on Microsoft SQL Server 2016 and utilizes cross-database queries to aggregate data across multiple departments.

You need to design a migration assessment strategy to discover the server communication patterns and evaluate database compatibility for Azure migration.

Which two actions should you include in the strategy? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Install the Dependency agent and the Log Analytics agent on the physical servers.; Use the Data Migration Assistant (DMA) to assess the SQL Server instances.

Answer

Install the Dependency agent and the Log Analytics agent on the physical servers, and use the Data Migration Assistant (DMA) to assess the SQL Server instances.
To discover server communication patterns on physical servers, agent-based dependency mapping is required, which is achieved by installing the Dependency agent and the Log Analytics agent on the target servers. To evaluate SQL Server database compatibility and detect blockers like cross-database queries, the Data Migration Assistant (DMA) must be used.

Step-by-Step Solution

1
Determine the required dependency discovery method for physical servers.
Identify that agent-based dependency analysis is necessary because agentless dependency analysis in Azure Migrate is only supported for VMware and Hyper-V virtual machines.
This step ensures that all network connections and ports used by the physical servers are accurately mapped despite the lack of documentation.
2
Assess the compatibility requirements of the database tier.
Identify that the database requires cross-database queries, which rules out Azure SQL Database single databases or elastic pools.
Running the Data Migration Assistant (DMA) will formally document this compatibility limitation and direct the strategy toward Azure SQL Managed Instance or SQL Server on Azure VMs.

Key Concept

Performing migration assessments for physical servers and evaluating database features against target Azure SQL services.
PreviousPage 17 / 18Next