Examkin

Design Infrastructure Solutions

360 questions

All types360Multiple choice189Multiple select171
Question 101Question →

A company has virtual machines (VMs) deployed in a subnet of an Azure virtual network. The VMs must securely access Azure Storage accounts. The design must block all general outbound internet traffic, prevent the need to manually update rules when Azure Storage IP addresses change, and minimize administrative overhead. Which two configurations should you include in the network security design?

Select all that apply

Show answer & explanation

Answer: Configure an outbound Network Security Group (NSG) rule with the destination set to the Storage service tag.; Enable a virtual network service endpoint for Storage on the subnet.

Answer

Configure an outbound Network Security Group (NSG) rule using the Storage service tag and enable a virtual network service endpoint for Storage on the subnet.
Configuring an outbound Network Security Group (NSG) rule with the Storage service tag allows traffic to reach Azure Storage without manual IP updates, and enabling a service endpoint on the subnet ensures that this traffic is routed privately over the Microsoft backbone network.

Step-by-Step Solution

1
Determine the outbound traffic requirements for the virtual machines.
VMs must connect to Azure Storage, but general outbound internet traffic must be restricted.
This establishes the security boundaries for the subnet's egress traffic.
2
Select a method to manage IP address ranges dynamically for the destination rules.
Use the Storage service tag as the destination for the NSG outbound rule.
Service tags group IP address prefixes for Azure services, managed automatically by Microsoft to avoid manual rule maintenance.
3
Select a routing path that ensures private and secure access to Azure Storage.
Enable a virtual network service endpoint for Storage on the VM subnet.
Service endpoints route traffic directly over the Microsoft backbone network, providing private access without sending traffic to the public internet.

Key Concept

Network Security and Private Access using Service Tags and Service Endpoints
Question 102Question →

A healthcare provider is designing a container-based claims processing application on Azure. The application has the following design requirements:

* A REST API microservice must receive claims and scale out rapidly during peak business hours, and scale down to zero instances during periods of inactivity.
* A background reporting workload must execute containerized jobs that process large datasets on a scheduled basis, with each job taking up to 45 minutes to complete.
* The overall solution must minimize administrative and infrastructure management overhead.

Which two Azure container hosting solutions should you recommend to meet these requirements? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the REST API microservice; Azure Container Apps jobs to host the background reporting workload

Answer

Azure Container Apps to host the REST API microservice, and Azure Container Apps jobs to host the background reporting workload.
Azure Container Apps is the optimal solution for both requirements. For the REST API microservice, Azure Container Apps provides serverless HTTP-based scaling, including scaling to zero when there is no traffic, while minimizing management overhead. For the background reporting workload, Azure Container Apps jobs are designed specifically for executing run-to-completion tasks that can run for up to 24 hours, meeting the 45-minute requirement without infrastructure management overhead.

Step-by-Step Solution

1
Evaluate the administrative overhead requirement.
Identify that Azure Kubernetes Service (AKS) introduces significant infrastructure management and platform overhead, making serverless options like Azure Container Apps more appropriate when Kubernetes API access is not explicitly required.
The scenario requires minimizing administrative and infrastructure management overhead.
2
Analyze the scaling and traffic patterns of the REST API microservice.
Determine that the REST API requires dynamic scaling based on HTTP requests, including scaling to zero. Azure Container Apps supports this natively out of the box.
Azure Container Instances does not offer built-in HTTP autoscaling to zero without external components.
3
Analyze the runtime requirements of the background reporting workload.
Identify that the background task is a containerized run-to-completion job that runs for up to 45 minutes. Azure Container Apps jobs support tasks running for up to 24 hours.
Azure Container Apps jobs are optimized for run-to-completion tasks, whereas standard Azure Container Apps are meant for continuously running services.

Key Concept

Selecting Azure container hosting solutions based on operational overhead, execution duration, and scaling requirements.
Question 103Question →

An enterprise is designing a serverless and containerized architecture for a financial reconciliation platform. The system requires hosting two workloads with distinct execution behaviors and networking constraints:

* Workload 1: An API gateway helper that intercepts and validates inbound transactions. It experiences unpredictable, highly spiked traffic (from 0 to thousands of concurrent requests) with long periods of complete inactivity. To access protected on-premises ledger databases, this workload requires integration with an Azure Virtual Network (VNet). Minimizing idle infrastructure costs is critical.
* Workload 2: A batch reconciliation job that runs once daily. The job retrieves transaction logs, executes complex audit rules, and typically runs for 40 minutes. It must also run within a private subnet to securely communicate with back-end databases, and the team wants to minimize operational overhead.

Which two of the following Azure compute solutions should you recommend to support these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Azure Functions on a Flex Consumption plan to host Workload 1; Azure Container Apps Jobs to host Workload 2

Answer

Azure Functions on a Flex Consumption plan to host the API gateway helper (Workload 1), and Azure Container Apps Jobs to host the daily batch reconciliation job (Workload 2).
The correct solution involves selecting Azure Functions on a Flex Consumption plan for the API endpoint and Azure Container Apps Jobs for the batch reconciliation job. The Flex Consumption plan supports virtual network integration while allowing the application to scale to zero instances during idle periods, satisfying the cost and network security requirements. Azure Container Apps Jobs are designed for run-to-completion workloads, support virtual network integration, can run for up to several hours, and avoid the management overhead associated with Kubernetes clusters.

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 requires virtual network integration, rapid scaling under unpredictable traffic spikes, and scale-to-zero capability to minimize costs during idle periods.
Identifying these key constraints narrows down the options to plans that support virtual network integration without requiring an always-on instance.
2
Evaluate compute candidates for Workload 1.
The Flex Consumption plan satisfies virtual network integration, rapid scale-out, and scales to zero. The Premium plan and Dedicated App Service plans fail the scale-to-zero cost requirement because they charge for a minimum of one running instance.
Matching constraints to Azure compute plans ensures the most cost-effective and compliant serverless host is chosen.
3
Analyze the requirements for Workload 2.
Workload 2 requires running a batch job for 40 minutes inside a private subnet while minimizing operational overhead.
This workload has a long-running execution requirement that exceeds standard serverless timeout limits, and a preference for low operational complexity.
4
Evaluate compute candidates for Workload 2.
Azure Container Apps Jobs support runs of up to several hours, run in a private subnet, scale to zero, and have low overhead. Standard Consumption Functions fail due to a 10-minute timeout. Azure Kubernetes Service (AKS) succeeds technically but introduces high operational overhead.
This step eliminates options that either fail due to execution limits or introduce excessive operational and financial overhead.

Key Concept

Azure serverless compute selection based on execution limits, virtual network integration, scaling behavior, and operational overhead.
Estimated Time:3m 0s
Question 104Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-core` (10.10.0.0/1610.10.0.0/16), hosts an Azure Firewall at 10.10.4.410.10.4.4 and an ExpressRoute Virtual Network Gateway. The ExpressRoute gateway connects to the on-premises network (192.168.0.0/16192.168.0.0/16) and receives a default route (0.0.0.0/00.0.0.0/0) via BGP to force-tunnel all internet traffic to the on-premises security appliance. A spoke virtual network, `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16), hosts a web application in `snet-web` (10.20.1.0/2410.20.1.0/24) and a database in `snet-db` (10.20.2.0/2410.20.2.0/24). You need to design a routing solution for `snet-web` to meet the following requirements:
- All traffic to other spoke virtual networks (which use the 10.0.0.0/810.0.0.0/8 address space) and the on-premises network must be routed through the Azure Firewall.
- Web servers in `snet-web` must communicate directly with the database in `snet-db` without passing through the Azure Firewall to minimize latency.
- All internet-bound traffic must be forced to the on-premises network via the ExpressRoute gateway.

Which route table configuration should you associate with `snet-web`?

Show answer & explanation

Answer: Associate a route table with gateway route propagation enabled. Add user-defined routes (UDRs) for 10.0.0.0/810.0.0.0/8 and 192.168.0.0/16192.168.0.0/16 with a next hop of Virtual Appliance pointing to the Azure Firewall (10.10.4.410.10.4.4).

Answer

Associate a route table with gateway route propagation enabled. Add user-defined routes (UDRs) for 10.0.0.0/810.0.0.0/8 and 192.168.0.0/16192.168.0.0/16 with a next hop of Virtual Appliance pointing to the Azure Firewall (10.10.4.410.10.4.4).
The correct configuration uses gateway route propagation to allow the subnet to dynamically learn the default route (0.0.0.0/00.0.0.0/0) advertised by the ExpressRoute gateway from on-premises, satisfying the forced tunneling requirement. By adding UDRs for 10.0.0.0/810.0.0.0/8 and 192.168.0.0/16192.168.0.0/16 pointing to the Azure Firewall, spoke-to-spoke and on-premises traffic is properly redirected for security inspection. Lastly, because Azure prioritizes routes using Longest Prefix Match (LPM), traffic destined for the database subnet (10.20.2.0/2410.20.2.0/24) will match the local VNet system route (10.20.0.0/1610.20.0.0/16) rather than the broader UDR (10.0.0.0/810.0.0.0/8), ensuring direct local communication without traversing the firewall.

Step-by-Step Solution

1
Evaluate the propagation of the default route.
Gateway route propagation must be enabled on the route table so that the subnet learns the BGP route 0.0.0.0/00.0.0.0/0 from the ExpressRoute Virtual Network Gateway.
This allows internet-bound traffic to be automatically routed to the ExpressRoute gateway for on-premises forced tunneling without needing a manual UDR.
2
Determine how to route spoke-to-spoke and on-premises traffic to the firewall.
Add user-defined routes (UDRs) for 10.0.0.0/810.0.0.0/8 and 192.168.0.0/16192.168.0.0/16 with the next hop set to the Azure Firewall IP (10.10.4.410.10.4.4).
This satisfies the security requirement to inspect all cross-virtual network and on-premises traffic using the hub firewall.
3
Analyze local virtual network routing under Longest Prefix Match (LPM) rules.
For traffic destined to 10.20.2.0/2410.20.2.0/24 (`snet-db`), Azure compares the system route 10.20.0.0/1610.20.0.0/16 (Virtual Network) and the UDR 10.0.0.0/810.0.0.0/8 (Virtual Appliance). Since 10.20.0.0/1610.20.0.0/16 is the longer prefix match, traffic is routed locally.
This ensures that traffic within the local VNet (`vnet-prod-spoke`) bypasses the firewall and maintains direct communication to minimize latency.

Key Concept

Azure Virtual Network routing priorities, specifically the interaction between User-Defined Routes (UDRs), BGP-propagated routes, and local VNet system routes using Longest Prefix Match (LPM).
Question 105Question →

You are designing a network security solution for an Azure virtual network. A subnet named Subnet1 contains 30 Azure virtual machines that need to retrieve cryptographic keys from Azure Key Vault. You must allow these virtual machines to make outbound connections to Azure Key Vault while blocking all other outbound access to the public internet. The solution must minimize the administrative effort required to maintain network security rules. Which of the following should you recommend including in the design?

Show answer & explanation

Answer: A Network Security Group (NSG) associated with Subnet1 that contains an outbound security rule allowing traffic where the destination is the AzureKeyVault service tag, followed by an outbound rule blocking all traffic to the Internet service tag.

Answer

A Network Security Group (NSG) associated with Subnet1 that contains an outbound security rule allowing traffic where the destination is the AzureKeyVault service tag, followed by an outbound rule blocking all traffic to the Internet service tag.
The correct option recommends using a Network Security Group (NSG) with the built-in AzureKeyVault service tag to allow traffic to Azure Key Vault, followed by a rule blocking traffic to the Internet service tag. Service tags simplify NSG rule creation and maintenance by representing a group of IP address prefixes from a given Azure service. Azure manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, satisfying the constraint to minimize administrative effort.

Step-by-Step Solution

1
Identify the destination service that the virtual machines need to communicate with, which is Azure Key Vault.
Determine that Azure Key Vault has a built-in Service Tag named AzureKeyVault.
Using service tags avoids the need to maintain static IP address lists, reducing administrative overhead.
2
Determine the rule hierarchy needed to permit the desired traffic while blocking all other outbound internet traffic.
Create an allow rule for the AzureKeyVault service tag and a deny rule for the Internet service tag with a lower priority.
NSG rules are processed in priority order, so the allow rule must be evaluated before the broader block rule.
3
Associate the configured NSG with Subnet1.
The network security rules are applied to all virtual machines within Subnet1.
Associating the NSG at the subnet level ensures uniform security policy application.

Key Concept

Azure Network Security Group Service Tags
Question 106Question →

A healthcare technology company is designing a secure cloud-native application on Azure to process patient data. The application requires two primary workloads:

* A front-end REST API that handles user requests, runs continuously, and scales dynamically based on incoming HTTP request volume.
* A background processing component that executes complex medical image analysis tasks. Each analysis task takes between 15 to 45 minutes to complete, must run in its own isolated container environment, and must scale down to zero when no tasks are in the queue.

You need to recommend a compute solution for the application. The design must minimize administrative and operational overhead.

Which two compute options should you recommend?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the front-end REST API; Azure Container Apps jobs to host the background medical image analysis tasks

Answer

Azure Container Apps to host the front-end REST API, and Azure Container Apps jobs to host the background medical image analysis tasks
The correct recommendation uses Azure Container Apps for the front-end REST API and Azure Container Apps jobs for the background medical image analysis. Azure Container Apps handles continuous HTTP-triggered workloads with automatic scaling and zero cluster management. Azure Container Apps jobs are designed for run-to-completion, event-triggered execution (such as processing from a queue) and support long-running processes up to multiple hours, which easily accommodates the 15 to 45-minute medical image analysis tasks while scaling down to zero when idle and minimizing management overhead.

Step-by-Step Solution

1
Analyze the REST API workload requirements.
The API runs continuously, scales based on HTTP requests, and needs minimal management. Azure Container Apps (ACA) provides serverless container hosting that scales on HTTP traffic and requires very low administrative overhead.
This establishes the best service for the web/API component.
2
Analyze the background image analysis workload requirements.
The background tasks are run-to-completion jobs that take 15 to 45 minutes. This exceeds the 10-minute timeout of serverless options like Azure Functions Consumption plans. Azure Container Apps jobs support longer executions, run containers in isolation, scale to zero, and have low overhead.
This establishes the best service for the long-running batch job component.
3
Evaluate the design constraints for operational efficiency.
Azure Kubernetes Service (AKS) meets the technical capability but introduces high management overhead (cluster upgrades, node pools), violating the 'minimize administrative effort' constraint. Therefore, AKS is ruled out.
This filters out viable but operationally heavy alternatives.

Key Concept

Azure Container Apps and Jobs vs. AKS and Serverless Functions
Question 107Question →

An enterprise is designing a secure network architecture in Azure for a processing workload. The architecture contains:

- A subnet named Subnet-Workload hosting several Virtual Machines (VMs) that do not have public IP addresses.
- An Azure Storage account containing critical data that the VMs must access.
- An Azure SQL Database that the VMs must query.

The design must satisfy the following security and administrative constraints:
- Direct administrative RDP/SSH access to the VMs must be provided securely without provisioning public IPs on the VMs, utilizing a fully managed PaaS solution.
- All database and storage traffic from the VMs must utilize private IP addresses within the virtual network and bypass the public internet.
- Network security rules must restrict outbound traffic from Subnet-Workload to only allowed Azure services with minimal maintenance overhead.
- Virtual network routing must not disrupt default traffic flow within the virtual network.

Which two solutions should you include in the architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy Azure Bastion in a dedicated subnet named AzureBastionSubnet to manage VM access.; Deploy Private Endpoints for the Azure SQL Database and the Azure Storage account in the virtual network.

Answer

Deploy Azure Bastion in a dedicated subnet named AzureBastionSubnet to manage VM access, and deploy Private Endpoints for the Azure SQL Database and the Azure Storage account in the virtual network.
Deploying Azure Bastion in a dedicated subnet enables secure administrative access via RDP and SSH directly from the Azure portal over TLS, eliminating the need for public IPs on the workload VMs. Deploying Private Endpoints for the Azure SQL Database and the Azure Storage account assigns private IP addresses from the virtual network to these services, securing the traffic on Microsoft's backbone network and eliminating exposure to the public internet.

Step-by-Step Solution

1
Evaluate the administrative access requirement to determine the most secure, low-overhead solution.
Azure Bastion is identified as the optimal fully managed PaaS solution to provide RDP/SSH access without public IPs.
This satisfies the constraint of secure administrative access without public IP addresses and with minimal effort.
2
Determine the secure private access mechanism for Azure SQL Database and Azure Storage.
Private Endpoints are selected to assign private IP addresses to these services within the virtual network.
This ensures all data traffic is kept off the public internet and conforms to the private access requirement.
3
Analyze the network security group requirements for service traffic.
Service Tags should be used instead of manually defined public IP address ranges.
Using individual IP rules increases operational complexity and violates the constraint of minimal maintenance overhead.
4
Verify routing requirements to ensure internal connectivity is preserved.
Default system routing is maintained without introducing overlapping custom user-defined routes that block local traffic.
This avoids breaking internal communications within the virtual network.

Key Concept

Designing secure administrative access and private access to Azure resources using Azure Bastion and Private Endpoints, while avoiding administrative overhead in routing and network security groups.
Estimated Time:2m 30s
Question 108Question →

You are designing the network security for an Azure solution. A group of virtual machines in an Azure virtual network subnet must be permitted to make outbound connections to Azure Key Vault. You need to define a rule in a Network Security Group (NSG) to allow this traffic. The solution must minimize administrative overhead and avoid the need to manually maintain changing IP address ranges. What should you specify as the destination in the NSG outbound rule?

Show answer & explanation

Answer: The AzureKeyVault Service Tag

Answer

The AzureKeyVault Service Tag
The AzureKeyVault Service Tag is a system-defined identifier that represents the public IP address prefixes for the Azure Key Vault service. Using a Service Tag in the Network Security Group (NSG) outbound rule allows the virtual machines to connect to Key Vault securely while delegating the updates and maintenance of the IP address ranges entirely to Azure, fulfilling the requirement to minimize administrative overhead.

Step-by-Step Solution

1
Identify the destination resource and communication requirements.
The destination is Azure Key Vault, an Azure PaaS service, and the traffic is outbound from Azure virtual machines.
This establishes the scope of the network rule needed within the Network Security Group (NSG).
2
Evaluate configuration methods against the constraint of minimizing administrative overhead and avoiding manual IP management.
Using individual IP ranges or routing changes introduces manual maintenance overhead and potential service disruption when IPs change. Service Tags are managed by Microsoft and dynamically update.
This determines that a Service Tag is the optimal mechanism to satisfy the security requirements with low administrative effort.
3
Select the correct Service Tag for the destination service.
The AzureKeyVault Service Tag represents the IP address prefixes for the Azure Key Vault service.
Specifying this Service Tag as the destination in the outbound NSG rule allows the required traffic securely and dynamically.

Key Concept

Azure Network Security Group Service Tags simplify NSG rule creation by representing groups of IP address prefixes from helper Azure services, managed automatically by Microsoft.
Question 109Question →

An enterprise is designing an Azure network infrastructure. The topology includes a hub virtual network named `vnet-weur-hub` (10.10.0.0/1610.10.0.0/16) peered with a spoke virtual network named `vnet-weur-spoke1` (10.20.0.0/1610.20.0.0/16). An active Network Virtual Appliance (NVA) is deployed in the hub virtual network in `snet-nva` (10.10.2.0/2410.10.2.0/24) with the private IP address 10.10.2.410.10.2.4.

The spoke virtual network `vnet-weur-spoke1` contains the following subnets:
* `snet-web` (10.20.1.0/2410.20.1.0/24) hosting front-end web servers.
* `snet-db` (10.20.2.0/2410.20.2.0/24) hosting database servers.

To inspect all inter-subnet traffic within the spoke, a network engineer associates a route table with `snet-web` containing a user-defined route (UDR) for 10.20.0.0/1610.20.0.0/16 pointing to the NVA at 10.10.2.410.10.2.4. However, this configuration prevents the web servers within `snet-web` from communicating with each other, breaking the application.

You need to restore communication between the web servers in `snet-web` while ensuring that all traffic from `snet-web` to `snet-db` (and any future subnets added to `vnet-weur-spoke1`) is routed through the NVA at 10.10.2.410.10.2.4. The design must minimize administrative overhead.

Which configuration should you add to the route table associated with `snet-web` to resolve the communication issue?

Show answer & explanation

Answer: Add a user-defined route for 10.20.1.0/2410.20.1.0/24 with the next hop type set to Virtual network.

Answer

Add a user-defined route for the local subnet prefix (10.20.1.0/2410.20.1.0/24) pointing to the Virtual network next hop type.
Adding a route for the local subnet prefix (10.20.1.0/2410.20.1.0/24) with a next hop type of Virtual network is correct because it uses the Longest Prefix Match (LPM) algorithm to override the broader 10.20.0.0/1610.20.0.0/16 UDR for local traffic only. This restores communication within the subnet while continuing to route traffic destined for other subnets (such as the database subnet) to the NVA. It also satisfies the administrative requirement because any future subnets created in the spoke VNet will automatically match the broader 10.20.0.0/1610.20.0.0/16 route and route to the NVA without needing manual route table modifications.

Step-by-Step Solution

1
Analyze the routing conflict in the route table.
The current user-defined route for 10.20.0.0/1610.20.0.0/16 pointing to the NVA overrides the default VnetLocal system route (10.20.0.0/1610.20.0.0/16 -> Virtual network) because they share the same prefix length, forcing all traffic (including intra-subnet traffic) to the NVA.
By default, Azure routes traffic within a VNet locally. When a UDR with the exact same prefix length is applied, it overrides this system route, sending all traffic matching that prefix to the NVA, which cannot hair-pin the traffic back to the same subnet.
2
Apply the Longest Prefix Match (LPM) rule.
A route with a more specific prefix (e.g., 10.20.1.0/2410.20.1.0/24) will take precedence over a route with a broader prefix (e.g., 10.20.0.0/1610.20.0.0/16).
Azure's routing decision is based first on the prefix length. The route with the longest prefix matches first.
3
Configure the local subnet override.
Adding a route for 10.20.1.0/2410.20.1.0/24 with the next hop set to Virtual network ensures that traffic within `snet-web` matches the /24 route and uses Azure's default local routing.
This restores intra-subnet communication while leaving the /16 route active for all other subnets within the VNet.
4
Evaluate administrative overhead.
Future subnets (e.g., 10.20.3.0/2410.20.3.0/24) will automatically fall under the 10.20.0.0/1610.20.0.0/16 route and route to the NVA without requiring manual route updates.
This satisfies the requirement to minimize administrative overhead as the network scales.

Key Concept

Azure routing precedence, specifically how User-Defined Routes (UDRs) interact with default system routes and the application of Longest Prefix Match (LPM) to override broad routing policies without increasing administrative overhead.
Question 110Question →

A retail company is designing an online order fulfillment system on Azure. The system will consist of several containerized microservices that communicate via an Azure Service Bus queue. The system must scale dynamically based on the number of active messages in the queue. The operations team wants to minimize the administrative effort required to manage the container infrastructure and has no experience with Kubernetes administration. Which service should you recommend?

Show answer & explanation

Answer: Azure Container Apps

Answer

Azure Container Apps
Azure Container Apps is the correct service because it is a serverless container platform that allows running microservices and background tasks without managing complex infrastructure. It includes built-in support for KEDA, which allows automatic event-driven scaling based on Azure Service Bus queue metrics, satisfying the scaling requirement with minimum administrative effort.

Step-by-Step Solution

1
Analyze the business and technical requirements of the scenario.
The requirements specify containerized microservices, dynamic scaling based on Azure Service Bus queue metrics, minimal administrative effort, and no Kubernetes administrative experience.
Identifying constraints helps filter out services that introduce excessive operational overhead or lack required features.
2
Evaluate the suitability of Azure container hosting options against the requirements.
Azure Container Apps natively supports scaling from zero based on queue length via built-in KEDA integration without requiring server or orchestrator management. Azure Kubernetes Service (AKS) requires management overhead, Azure Container Instances (ACI) lacks native queue-based autoscaling, and Azure Functions has execution timeouts and is not optimal for standard containerized microservices.
Comparing features against the constraints ensures the recommended solution aligns with Microsoft Best Practices.
3
Select the option that matches all requirements with the lowest administrative overhead.
Azure Container Apps satisfies all conditions.
Azure Container Apps is designed for microservices scaling on event triggers without requiring Kubernetes expertise.

Key Concept

Selecting the appropriate Azure container hosting service based on scaling requirements and administrative overhead.
Estimated Time:1m 30s
Question 111Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-weur-hub` (address space: 10.100.0.0/1610.100.0.0/16), contains a subnet `snet-firewall` (10.100.1.0/2410.100.1.0/24) hosting a firewall Network Virtual Appliance (NVA) at IP address 10.100.1.410.100.1.4. Another subnet in the hub, `snet-shared` (10.100.2.0/2410.100.2.0/24), hosts a shared DNS server at IP address 10.100.2.1010.100.2.10.

The spoke virtual network, `vnet-weur-prod-app` (address space: 10.110.0.0/1610.110.0.0/16), is connected to `vnet-weur-hub` using virtual network peering with default settings. Inside `vnet-weur-prod-app`, there are two subnets: `snet-web` (10.110.10.0/2410.110.10.0/24) hosting web servers and `snet-db` (10.110.20.0/2410.110.20.0/24) hosting database servers (including a database server at 10.110.20.510.110.20.5).

To enforce security, a route table named `rt-snet-web` is associated with `snet-web` and configured with the following user-defined routes (UDRs):
- Route 1: Address prefix 0.0.0.0/00.0.0.0/0, Next hop type: Virtual appliance, Next hop IP address: 10.100.1.410.100.1.4
- Route 2: Address prefix 10.0.0.0/810.0.0.0/8, Next hop type: Virtual appliance, Next hop IP address: 10.100.1.410.100.1.4

What is the routing behavior for outbound traffic originating from a web server in `snet-web` (10.110.10.510.110.10.5) destined for the database server (10.110.20.510.110.20.5) and the DNS server (10.100.2.1010.100.2.10)?

Show answer & explanation

Answer: Traffic to both the database server and the DNS server bypasses the firewall NVA.

Answer

Traffic to both the database server and the DNS server bypasses the firewall NVA.
The correct answer is that traffic to both the database server and the DNS server bypasses the firewall NVA. This occurs because Azure selects routes based on the longest prefix match (LPM) algorithm first. The destination IP of the database server (10.110.20.510.110.20.5) matches the system route 10.110.0.0/1610.110.0.0/16 (next hop: Virtual Network) and the UDR 10.0.0.0/810.0.0.0/8 (next hop: Virtual Appliance). The prefix length of 1616 is longer than 88, so the system route wins, keeping traffic direct. Similarly, the destination IP of the DNS server (10.100.2.1010.100.2.10) matches the peering system route 10.100.0.0/1610.100.0.0/16 (next hop: VNet Peering) and the UDR 10.0.0.0/810.0.0.0/8. The prefix length of 1616 is longer than 88, so the peering system route wins, bypassing the firewall NVA.

Step-by-Step Solution

1
Evaluate the destination IP address for the database server and compare matching route prefixes.
For the database server at 10.110.20.510.110.20.5, the matching routes are the local system route 10.110.0.0/1610.110.0.0/16 (next hop: Virtual Network) and the UDR 10.0.0.0/810.0.0.0/8 (next hop: Virtual Appliance).
Azure routing uses the longest prefix match (LPM) algorithm to determine the winning route.
2
Select the winning route for the database server destination.
The local system route 10.110.0.0/1610.110.0.0/16 has a longer prefix length (1616) than the UDR 10.0.0.0/810.0.0.0/8 (88). Therefore, the system route is selected, keeping the traffic direct and bypassing the NVA.
A more specific prefix (longer subnet mask) takes precedence over a less specific prefix.
3
Evaluate the destination IP address for the DNS server and compare matching route prefixes.
For the DNS server at 10.100.2.1010.100.2.10, the matching routes are the peering system route 10.100.0.0/1610.100.0.0/16 (next hop: VNet Peering) and the UDR 10.0.0.0/810.0.0.0/8 (next hop: Virtual Appliance).
LPM must be applied to determine if the peering route or the UDR is selected.
4
Select the winning route for the DNS server destination.
The peering system route 10.100.0.0/1610.100.0.0/16 has a longer prefix length (1616) than the UDR 10.0.0.0/810.0.0.0/8 (88). Therefore, the peering route is selected, causing traffic to bypass the NVA.
Like the local route, the peering system route is more specific than the UDR.

Key Concept

Azure Virtual Network routing uses the longest prefix match algorithm to select routes. User-defined routes only override system routes of the exact same prefix length; a more specific system route will always take precedence over a broader user-defined route.
Question 112Question →

You are designing the hosting infrastructure for a new reporting solution in Azure that consists of two distinct workloads:

* Workload 1: A REST API frontend that receives metadata and writes it to a database. It experiences highly unpredictable, infrequent traffic spikes. Minimizing idle costs is a critical requirement, and the hosting environment must scale to zero when there is no traffic.
* Workload 2: A PDF generation engine triggered by queue messages. The report generation process can take up to 20 minutes to complete. The service must access an image library hosted on an on-premises server connected via an Azure Virtual Network.

You need to select the compute options that meet the requirements while minimizing both administrative overhead and cost.

Which hosting configuration should you recommend?

Show answer & explanation

Answer: Workload 1 hosted on Azure Functions (Consumption plan); Workload 2 hosted on Azure Functions (Premium plan)

Answer

Workload 1 hosted on Azure Functions (Consumption plan); Workload 2 hosted on Azure Functions (Premium plan)
The configuration using the Consumption plan for the REST API frontend and the Premium plan for the PDF generation engine meets all constraints. The REST API frontend requires scaling to zero to minimize idle costs during periods of no traffic, which is a native feature of the Azure Functions Consumption plan. The PDF generation engine requires an execution time of up to 20 minutes and virtual network connectivity; the Premium plan supports virtual network integration and has a maximum execution limit of 30 minutes (or can be configured to be unbounded), making it the ideal choice while maintaining low administrative overhead.

Step-by-Step Solution

1
Analyze the requirements for Workload 1.
Workload 1 requires scaling to zero to minimize idle costs due to infrequent and unpredictable traffic.
Azure Functions Consumption plan is serverless and scales to zero, charging only for active executions, which fits this requirement.
2
Analyze the requirements for Workload 2.
Workload 2 requires a timeout threshold of at least 20 minutes and virtual network integration to access the on-premises file server.
Azure Functions Premium plan supports virtual network integration and offers configurable execution timeouts of up to 30 minutes (or unbounded), satisfying both requirements.
3
Evaluate the administrative overhead of the options.
Using Azure Functions (Premium plan) for Workload 2 offers a fully managed platform as a service (PaaS) with low administrative overhead compared to containers hosted on Azure Kubernetes Service (AKS).
Azure Kubernetes Service requires managing cluster nodes, upgrades, and complex networking, which increases administrative overhead.

Key Concept

Selecting Azure serverless hosting plans based on execution limits, virtual network integration, and scaling-to-zero capabilities.
Question 113Question →

A multinational retail company is designing a container-based processing backend for an e-commerce platform that operates in both the United States (US) and the European Union (EU). The application has the following design requirements:

* Scale container instances dynamically from zero based on queue metrics using Kubernetes Event-driven Autoscaling (KEDA).
* Utilize Dapr for simplified service-to-service communication between microservices.
* Minimize administrative effort and operational overhead for managing the underlying host infrastructure.
* Comply with strict regulatory data residency laws that require log data for EU and US transactions to be isolated within their respective regions, preventing any cross-region consolidation.

Which infrastructure design should you recommend for the container hosting and logging?

Show answer & explanation

Answer: Deploy the microservices to Azure Container Apps, and configure two separate regional Log Analytics workspaces (one in the US and one in the EU) to collect the logs.

Answer

Deploying the microservices to Azure Container Apps and configuring two separate regional Log Analytics workspaces (one in the US and one in the EU) satisfies all compute and compliance requirements.
Deploying the microservices to Azure Container Apps and configuring two separate regional Log Analytics workspaces is correct. Azure Container Apps is a serverless platform that supports microservice features like KEDA scaling and Dapr out of the box with minimal management overhead. Configuring two separate regional workspaces ensures that data is stored locally within each region, satisfying strict compliance regulations regarding physical log isolation.

Step-by-Step Solution

1
Assess the compute requirements for KEDA, Dapr, and operational effort.
Azure Container Apps natively supports KEDA scaling and Dapr integration, and operates as a serverless service with less administrative effort than Azure Kubernetes Service.
Azure Container Apps abstracts the underlying Kubernetes cluster management while still providing enterprise container capabilities.
2
Evaluate the compliance requirements for log data residency.
Separate Log Analytics workspaces are required in the United States and the European Union regions to ensure physical data isolation.
A single centralized workspace would consolidate the log data across regions, violating the physical data residency boundary requirement.
3
Select the option that matches the optimal compute and logging configuration.
The configuration using Azure Container Apps with two separate regional workspaces satisfies all design constraints.
It achieves serverless container execution with native microservices features and respects regulatory boundaries.

Key Concept

Evaluating Azure container hosting services and regional log workspace boundaries to meet performance and regulatory requirements.
Question 114Question →

An enterprise is planning to migrate a core transaction processing database to Azure. The database has the following requirements:
- Hardware isolation: The workloads must run on dedicated physical hardware that is not shared with other tenants.
- Availability: The compute tier must guarantee a 99.99% uptime SLA.
- Workload profile: The database requires high-memory capacity and low-latency storage access.

Which compute virtualization solution should you recommend to meet these requirements?

Show answer & explanation

Answer: Deploy Azure Dedicated Hosts across at least two Availability Zones, and configure a Virtual Machine Scale Set in Flexible orchestration mode using Esv5-series Virtual Machines.

Answer

Deploy Azure Dedicated Hosts across at least two Availability Zones, and configure a Virtual Machine Scale Set in Flexible orchestration mode using Esv5-series Virtual Machines.
Deploying Azure Dedicated Hosts across at least two Availability Zones and using Esv5-series VMs in a Flexible orchestration VM Scale Set meets all requirements. Azure Dedicated Hosts fulfill the hardware isolation requirement. Spreading hosts across multiple zones satisfies the 99.99% SLA requirement. Esv5-series VMs provide the memory-optimized resources required for transaction processing databases.

Step-by-Step Solution

1
Analyze compliance and hardware isolation requirements.
Azure Dedicated Hosts are identified as the necessary compute resource since they provide physical servers dedicated to a single Azure subscription.
Regulatory compliance forbids sharing physical hardware with other tenants.
2
Determine the high availability (SLA) deployment strategy.
Determine that the Dedicated Hosts must be distributed across at least two Availability Zones in the target region.
Azure SLA requires at least two hosts deployed across two zones (or fault domains) to guarantee a 99.99% uptime SLA for the virtual machines.
3
Select the correct VM series based on the database profile.
Select Esv5-series Virtual Machines.
Esv5-series VMs are memory-optimized and support premium storage, which meets the high-memory and low-latency storage demands of the database.

Key Concept

Designing compute virtualization solutions with Azure Dedicated Hosts and VM Scale Sets to meet compliance, high availability, and specific workload profile requirements.
Question 115Question →

You are designing the serverless compute architecture for a reporting system that consists of two distinct workloads:

* Workload 1: A data processing service that runs in response to file uploads. Each execution takes up to 25 minutes to complete. The service requires access to an Azure Files share.
* Workload 2: A microservice that processes messages from an Azure Service Bus queue. The service must scale down to zero instances when no messages are present in the queue, and must scale out rapidly during peak loads. The application has no existing Kubernetes configuration, and you must minimize operational and infrastructure overhead.

Which two compute configurations should you recommend?

Select all that apply

Show answer & explanation

Answer: For Workload 1, deploy an Azure Container Apps Job.; For Workload 2, deploy an Azure Container App.

Answer

Deploy an Azure Container Apps Job for Workload 1 and an Azure Container App for Workload 2.
The correct architecture uses an Azure Container Apps Job for Workload 1 and an Azure Container App for Workload 2. An Azure Container Apps Job is designed for run-to-completion containerized tasks, supports execution times beyond 10 minutes (up to 24 hours), and supports mounting Azure Files shares. An Azure Container App is designed for microservices, supports scaling to zero based on Service Bus queue length via KEDA, and provides a serverless model that minimizes operational overhead, avoiding the infrastructure management required by Azure Kubernetes Service (AKS).

Step-by-Step Solution

1
Analyze Workload 1 execution duration and storage requirements.
Workload 1 runs for up to 25 minutes and requires an Azure Files share mount. Azure Functions on a Consumption plan has a strict 10-minute timeout limit and cannot host this workload.
This rules out standard Consumption plan serverless functions and requires a compute solution that supports longer runtimes and file share integration.
2
Select the correct compute option for Workload 1.
An Azure Container Apps Job is selected. Container Apps Jobs run containers to completion, support execution times of up to 24 hours, and support mounting Azure Files shares.
This configuration meets all requirements of Workload 1 with minimal administrative overhead.
3
Analyze Workload 2 scaling and operational overhead constraints.
Workload 2 must scale to zero when idle, scale out rapidly under load, and minimize operational overhead. There is no existing Kubernetes investment.
This excludes Azure Kubernetes Service (AKS) because AKS introduces significant administrative overhead for managing Kubernetes infrastructure.
4
Select the correct compute option for Workload 2.
An Azure Container App is selected. Azure Container Apps are fully managed, scale to zero using KEDA based on queue length, and avoid the infrastructure overhead of AKS.
This matches all scale-to-zero and low-overhead requirements for a queue-based containerized microservice.

Key Concept

Azure serverless and container hosting options require matching workload runtime limits, storage integrations, and scaling requirements to the appropriate service while minimizing operational overhead.
Question 116Question →

A company has a regional TCP-based application deployed on Azure Virtual Machines in a single region. The virtual machines use Standard SKU public IP addresses. The solution must distribute TCP traffic at the transport layer and support the existing Standard SKU resources without configuration validation errors. Which load balancing service should you recommend?

Show answer & explanation

Answer: Azure Standard Load Balancer

Answer

Azure Standard Load Balancer
Azure Standard Load Balancer operates at Layer 4 (TCP/UDP) and supports backend resources configured with Standard SKU public IP addresses. Since the application requires regional TCP load balancing and the virtual machines have Standard SKU public IPs, the Standard Load Balancer is the correct choice and avoids SKU validation errors.

Step-by-Step Solution

1
Identify the protocol and routing requirements.
The application requires regional load balancing for TCP (Layer 4) traffic without HTTP-specific features.
This rules out HTTP/HTTPS application-layer load balancers like Azure Front Door.
2
Check the SKU requirements of the backend resources.
The backend virtual machines are configured with Standard SKU public IP addresses.
To prevent SKU mismatch validation errors, the load balancer SKU must match the backend public IP resource SKU (both must be Standard).
3
Select the load balancer that matches both layer and SKU constraints.
Azure Standard Load Balancer operates at Layer 4 and is compatible with Standard SKU backend resources.
This satisfies all constraints without validation failures.

Key Concept

Azure Load Balancer SKU matching and protocol constraints
Question 117Question →

A financial services firm is planning to migrate a core risk-modeling simulation workload to Azure. The application has the following requirements:
- Complete physical isolation at the hardware level for the underlying physical servers to meet strict compliance mandates.
- In-memory data protection during processing using hardware-based enclaves that support Intel Software Guard Extensions (SGX).
- An overall availability service level agreement (SLA) of 99.99% for the virtual machines.
- The workload runs continuously and cannot tolerate unexpected evictions or interruptions.

Which two of the following configurations should you include in the infrastructure design to meet the requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Azure Dedicated Hosts using the DCsv3-Type1 host size; A host group distributed across at least two Availability Zones

Answer

To meet the requirements, the architecture must include Azure Dedicated Hosts using the DCsv3-Type1 host size and a host group distributed across at least two Availability Zones.
The correct design utilizes Azure Dedicated Hosts using the DCsv3-Type1 host size distributed across at least two Availability Zones. The DCsv3-Type1 host size supports DCsv3-series VMs, which provide the required physical isolation and hardware-enclave protection using Intel SGX. Distributing the hosts across at least two zones ensures the design meets the 99.99% virtual machine availability SLA.

Step-by-Step Solution

1
Identify the compute family that supports the security requirements.
The DCsv3-series virtual machines and DCsv3-Type1 Dedicated Hosts are selected.
Intel SGX-based confidential computing enclaves are supported on DCsv3-series VMs, whereas ECasv5 or other series do not support SGX enclaves.
2
Evaluate high availability and SLA constraints.
A Host Group distributed across at least two Availability Zones must be used.
Azure SLA for Dedicated Hosts requires spreading hosts across at least two zones to guarantee 99.99% VM connectivity.
3
Filter out solutions that introduce eviction risk or fail hardware isolation.
Spot VMs and Consumption-based Azure Functions are ruled out.
Spot VMs are prone to evictions and cannot run on Dedicated Hosts. Azure Functions Consumption plan lacks physical hardware isolation and has execution timeouts.

Key Concept

Designing high-availability and confidential compute solutions using Azure Dedicated Hosts and Intel SGX-enabled virtual machines.
Question 118Question →

An organization is designing the hosting architecture for a new multi-tenant financial application. The solution consists of the following components:

* A Web API that processes incoming payment verification requests. The API must scale down to zero instances during idle periods to minimize costs, must scale out within seconds to handle unpredictable spikes of up to 5,0005,000 concurrent requests, and must connect to a database hosted within a secured Azure Virtual Network (VNet).
* A daily ledger reconciliation process that aggregates data from external feeds and updates the database. The reconciliation process takes approximately 45 minutes to execute and must run inside the same VNet.

You need to select the most cost-effective Azure compute hosting options that satisfy these requirements.

Which hosting combination should you recommend?

Show answer & explanation

Answer: Azure Container Apps for the Web API, and an Azure Container Apps Job for the ledger reconciliation process.

Answer

Azure Container Apps for the Web API, and an Azure Container Apps Job for the ledger reconciliation process.
The combination of Azure Container Apps and an Azure Container Apps Job satisfies all constraints. Azure Container Apps can scale to zero when idle to minimize costs, scales out rapidly, and supports VNet integration to access the secure database. Azure Container Apps Jobs are optimized for run-to-completion batch processes, support VNet integration, and allow execution times up to 24 hours, meaning they will not time out during the 45-minute daily reconciliation run.

Step-by-Step Solution

1
Analyze the scaling and network requirements of the Web API component.
The API requires rapid scaling to handle spikes, scaling to zero to minimize idle costs, and Azure Virtual Network (VNet) integration to access the database.
Azure Container Apps supports scaling to zero and native VNet integration, satisfying all Web API criteria.
2
Analyze the execution and network requirements of the ledger reconciliation process.
The reconciliation process is a run-to-completion task requiring 45 minutes of execution time and VNet integration.
This rules out Azure Functions on a Consumption plan due to its 10-minute execution limit.
3
Evaluate the remaining options to identify the most cost-effective serverless hosting combination.
An Azure Container Apps Job runs on demand, supports VNet integration, allows long execution times (up to 24 hours), and does not require pre-warmed running instances.
Azure Container Apps combined with Azure Container Apps Jobs satisfies all requirements with minimal cost and operational overhead.

Key Concept

Selecting serverless and web application hosting plans based on execution limits, virtual network requirements, and cost-effective scaling patterns.
Estimated Time:2m 30s
Question 119Question →

You are designing a regional TCP-based application infrastructure. You deploy a Standard Azure Load Balancer to distribute inbound traffic across a backend pool of Azure Virtual Machines in a single virtual network. However, when you attempt to add the virtual machines to the backend pool, the configuration fails validation. Which of the following is the most likely cause of this validation failure?

Show answer & explanation

Answer: The virtual machines are associated with Basic SKU public IP addresses.

Answer

The virtual machines are associated with Basic SKU public IP addresses.
The correct option is correct because Azure Standard Load Balancer requires all resources in the backend pool to match its SKU tier. If the virtual machines have Basic SKU public IP addresses attached to their network interfaces, the configuration will fail verification due to SKU mismatch constraints.

Step-by-Step Solution

1
Identify the load balancer SKU being deployed.
The scenario specifies a Standard Azure Load Balancer.
Standard Load Balancers have strict SKU matching requirements for backend resources.
2
Check the SKU requirements for virtual machines in the backend pool.
All virtual machine network interfaces (NICs) and their associated public IP addresses must be Standard SKU.
Standard SKU load balancers do not support mixing Basic SKU public IPs within the same backend pool.
3
Determine the cause of the configuration failure.
The virtual machines are using Basic SKU public IP addresses, preventing successful backend pool association.
Upgrading the public IPs to Standard SKU or removing them is required to resolve the validation failure.

Key Concept

Azure Load Balancer SKU boundary and compatibility constraints
Question 120Question →

A university library is designing an automated document archiving system to merge and compress digitized historical manuscripts into PDF/A format.

The system must meet the following requirements:
* Each document merging task is triggered by a message in an Azure Service Bus queue.
* A single archiving task takes between 1212 and 1818 minutes to complete.
* The archiving engine is packaged as a custom Linux-based container image that requires specialized PDF rendering libraries.
* The system must incur zero compute costs when there are no archiving tasks in the queue.
* Infrastructure management and operational overhead must be minimized.

Which Azure compute solution should you recommend?

Show answer & explanation

Answer: Azure Container Apps jobs

Answer

Azure Container Apps jobs
Azure Container Apps jobs are optimized for run-to-completion tasks triggered by events such as queue messages. They support custom containers, can scale down to zero instances (resulting in zero compute cost when idle), support execution durations of up to 2424 hours, and require no cluster management, aligning perfectly with all constraints.

Step-by-Step Solution

1
Analyze the execution duration requirement of 1212 to 1818 minutes.
Azure Functions on a Consumption plan is ruled out because its maximum execution timeout is 1010 minutes.
Selecting a platform with an execution limit lower than the task duration leads to timeout failures.
2
Evaluate the custom container and operational overhead requirements.
Azure Kubernetes Service (AKS) is ruled out because it introduces significant infrastructure management and operational overhead.
The scenario requires minimizing operational overhead, making managed serverless container hosting a better fit than full Kubernetes orchestration.
3
Evaluate the reliability and cost requirements.
Spot Virtual Machines are ruled out because of eviction risks during long-running tasks, and Azure Container Apps jobs is selected because it scales to zero and supports custom containers.
Azure Container Apps jobs natively support scaling to zero cost when idle, accommodate executions up to 2424 hours, run custom containers, and are fully managed.

Key Concept

Selecting serverless hosting options based on execution duration, custom container support, cost efficiency, and operational overhead.
PreviousPage 6 / 18Next
Design Infrastructure Solutions Practice Questions — Microsoft Azure Solutions Architect (AZ-305) — Page 6 | Examkin