Examkin

Design Infrastructure Solutions

360 questions

All types360Multiple choice189Multiple select171
Question 141Question →

An organization named Apex Bioscience is designing a secure networking architecture for a high-performance computing workload. The workload runs on Azure Virtual Machines deployed in a subnet named AnalysisSubnet within a virtual network named VNet1. The virtual machines must read and write data to multiple company-owned Azure Storage accounts located in the East US region. The security architecture must satisfy the following technical constraints:
- Outbound network traffic from AnalysisSubnet to the Azure Storage accounts must remain on the Microsoft backbone network and never traverse the public internet.
- Virtual machines must be prevented from exfiltrating data to any unauthorized or external Azure Storage accounts.
- The solution must minimize administrative overhead to implement and maintain as new company-owned storage accounts are provisioned in the East US region.

Which security component should you recommend to meet these requirements?

Show answer & explanation

Answer: Virtual Network service endpoint policies applied to AnalysisSubnet that permit access to the company's Azure subscriptions.

Answer

Virtual Network service endpoint policies applied to AnalysisSubnet that permit access to the company's Azure subscriptions.
Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts. By configuring a policy that permits access only to the company's Azure subscriptions, you ensure that virtual machines in the subnet can only connect to authorized storage accounts, thereby preventing data exfiltration to external accounts. Traffic to these service endpoints remains on the Microsoft backbone network and does not traverse the public internet. Since the policy applies to the entire subscription level, any newly provisioned storage accounts within those subscriptions are automatically covered without requiring updates to the network configuration, which minimizes administrative overhead.

Step-by-Step Solution

1
Analyze the requirements for network path isolation.
Traffic must remain on the Microsoft backbone network and must not traverse the public internet, which rules out routing traffic via the default internet gateway.
Ensures compliance with the data transit security policy.
2
Evaluate mechanisms to prevent data exfiltration to unauthorized Azure Storage accounts.
Standard NSG service tags for Storage allow access to all storage accounts in the region, which is insufficient. We must be able to scope access to only specific authorized accounts, subscriptions, or resource groups.
Ensures that data cannot be copied to external or personal storage accounts.
3
Determine the solution with the lowest administrative overhead.
Virtual Network service endpoint policies scoped to the company's subscriptions allow automatic access to newly created company storage accounts without manual updates. Managing individual IP rules in NSGs or individual routes in UDRs requires high administrative effort.
Supports scalability and satisfies the administrative constraint.

Key Concept

Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts, preventing data exfiltration while keeping traffic on the Microsoft backbone network.
Estimated Time:2m 0s
Question 142Question →

Your company is designing a secure network architecture in Azure. You have a virtual network named VNet1 containing a subnet named AppSubnet. Virtual machines in AppSubnet must connect to Azure Key Vault and Azure Storage.

The security team has the following requirements:
- Direct public internet connectivity from AppSubnet must be blocked.
- Administrative overhead for maintaining IP address changes of Azure services must be minimized.
- Communication with Azure Storage and Azure Key Vault must be allowed, while all other outbound traffic is denied.

You decide to use a Network Security Group (NSG) associated with AppSubnet to control outbound traffic.

Which two configurations should you recommend for the Network Security Group (NSG) outbound rules? (Select two.)

Select all that apply

Show answer & explanation

Answer: An outbound security rule that allows traffic to the Storage service tag.; An outbound security rule that allows traffic to the AzureKeyVault service tag.

Answer

Configure an outbound security rule that allows traffic to the Storage service tag, and configure an outbound security rule that allows traffic to the AzureKeyVault service tag.
To satisfy the requirements of securing outbound communication to Azure Storage and Azure Key Vault while avoiding administrative overhead, you should use Azure Service Tags in the Network Security Group. A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing administrative effort.

Step-by-Step Solution

1
Identify the target Azure services that the virtual machines in AppSubnet need to access.
The target services are Azure Storage and Azure Key Vault.
This establishes the scope of traffic that must be explicitly permitted through the security controls.
2
Evaluate the mechanism that minimizes administrative overhead for maintaining changing service IP addresses.
Azure Service Tags represent groups of IP address prefixes managed entirely by Microsoft.
Using Service Tags like 'Storage' and 'AzureKeyVault' eliminates the need to manually track and update rule IP addresses when Azure updates service endpoints.
3
Formulate the outbound rules for the Network Security Group.
Add two high-priority outbound rules to allow the Storage and AzureKeyVault service tags as destinations, combined with a default or lower-priority rule to block all other outbound internet traffic.
This satisfies the security requirement to block general internet access while allowing access only to the authorized Azure services.

Key Concept

Azure Network Security Group Service Tags
Question 143Question →

An enterprise designs a hub-and-spoke virtual network topology in Azure. The hub virtual network is `vnet-hub-prod` (10.10.0.0/1610.10.0.0/16) and hosts an Azure Firewall at 10.10.1.410.10.1.4. The spoke virtual network is `vnet-spoke-app` (10.20.0.0/1610.20.0.0/16) and contains two subnets: `subnet-web` (10.20.1.0/2410.20.1.0/24) and `subnet-db` (10.20.2.0/2410.20.2.0/24). The virtual networks are connected via Virtual Network Peering.

The administrator wants to route all traffic from `subnet-web` to `subnet-db` through the Azure Firewall for security inspection. To achieve this, the administrator creates a route table and associates it with `subnet-web`.

Which route configuration should be added to the route table to inspect traffic destined for `subnet-db` while ensuring that local traffic within `subnet-web` and traffic to other potential subnets in `vnet-spoke-app` continues to route directly within the virtual network?

Show answer & explanation

Answer: Address prefix: 10.20.2.0/2410.20.2.0/24; Next hop type: Virtual appliance; Next hop address: 10.10.1.410.10.1.4

Answer

Configure a User Defined Route with an Address prefix of 10.20.2.0/2410.20.2.0/24, Next hop type of Virtual appliance, and Next hop address of 10.10.1.410.10.1.4.
The correct answer specifies a route for the specific database subnet prefix (10.20.2.0/2410.20.2.0/24) with a next hop type of Virtual appliance pointing to the firewall IP (10.10.1.410.10.1.4). By using a more specific prefix, Azure uses Longest Prefix Match (LPM) to route database traffic to the firewall, while traffic within the web subnet or to other subnets continues to use the less-specific system route (10.20.0.0/1610.20.0.0/16 -> Virtual Network).

Step-by-Step Solution

1
Analyze the destination target prefix requirements.
The target subnet is `subnet-db` (10.20.2.0/2410.20.2.0/24), while the rest of the virtual network is `vnet-spoke-app` (10.20.0.0/1610.20.0.0/16).
Determining the correct prefix prevents over-routing and maintains local virtual network connectivity.
2
Determine the routing priority and longest prefix match (LPM) logic in Azure.
A route targeting 10.20.2.0/2410.20.2.0/24 is more specific than the default local system route of 10.20.0.0/1610.20.0.0/16.
Azure routes traffic using the longest prefix match. A route for 10.20.2.0/2410.20.2.0/24 will only affect traffic going to the database subnet, leaving traffic to 10.20.1.0/2410.20.1.0/24 or other parts of the spoke to follow the system route.
3
Select the correct next hop type and IP address for the firewall.
Next hop type should be Virtual appliance, and the next hop IP address should be the Azure Firewall's private IP (10.10.1.410.10.1.4).
Azure Firewall acts as a network virtual appliance (NVA) and routing to it requires the Virtual appliance next hop type.

Key Concept

Azure Route Selection and Longest Prefix Match (LPM)
Question 144Question →

An organization is planning to migrate a business-critical application suite from an on-premises datacenter hosting physical servers and VMware vSphere virtual machines to Azure. During the assessment phase, the following technical requirements and constraints are identified:

* The backend database layer consists of multiple SQL Server databases on physical servers that perform cross-database queries, utilize SQL Server Agent for scheduled maintenance, and execute CLR assembly routines.
* The application servers are hosted on VMware vSphere VMs and have undocumented TCP connections to external partner APIs.
* For hybrid identity, users must authenticate against the on-premises Active Directory Domain Services (AD DS) in real time to meet security compliance, but the organization wants to minimize on-premises infrastructure footprint and administrative overhead.

Which combination of Azure Migrate assessment strategies, target database service tiers, and Microsoft Entra ID hybrid identity solutions should you recommend to meet all migration requirements?

Show answer & explanation

Answer: Enable Azure Migrate agent-based dependency analysis for all application servers, select Azure SQL Managed Instance as the database migration target, and implement Microsoft Entra Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO).

Answer

Enable Azure Migrate agent-based dependency analysis for all application servers, select Azure SQL Managed Instance as the database migration target, and implement Microsoft Entra Pass-through Authentication (PTA) with Seamless Single Sign-On (SSO).
The correct recommendation is to enable agent-based dependency analysis to map the undocumented connections to external partner APIs, use Azure SQL Managed Instance to support SQL Server Agent, cross-database queries, and CLR, and deploy Pass-through Authentication (PTA) with Seamless SSO to validate credentials against the on-premises directory in real time with minimal footprint.

Step-by-Step Solution

1
Determine the database service tier required for the backend SQL databases.
Azure SQL Managed Instance
The databases require SQL Server Agent, cross-database queries, and CLR integration, which are not supported in Azure SQL Database single databases or elastic pools but are fully supported in Azure SQL Managed Instance.
2
Select the hybrid identity synchronization and authentication mechanism.
Microsoft Entra Pass-through Authentication (PTA) with Seamless SSO
PTA validates passwords directly against the on-premises AD DS in real time using lightweight agents, meeting compliance requirements without the heavy footprint and high administrative overhead of Active Directory Federation Services (AD FS).
3
Determine the dependency analysis strategy for the application servers.
Azure Migrate agent-based dependency analysis
Agent-based dependency analysis installs agents on the servers to capture all TCP connections, which is required to accurately map undocumented connections to external partner APIs where agentless discovery cannot retrieve connection details.

Key Concept

Selecting migration assessment and target service strategies based on legacy application compatibility, networking dependency mapping, and hybrid identity constraints.
Question 145Question →

You are designing a serverless processing pipeline for an IoT platform. Devices upload binary log files to an Azure Storage account. A custom executable packaged in a Linux container must run to extract anomaly metrics from each log file. The extraction process takes approximately 12 minutes per file. The solution must scale automatically based on demand, scale to zero when no logs are uploaded, and avoid any running compute charges when idle. Which hosting option should you select to meet these requirements?

Show answer & explanation

Answer: Azure Container Apps event-driven jobs

Answer

Azure Container Apps event-driven jobs
Azure Container Apps event-driven jobs is the correct hosting option because it can run containerized tasks on demand, supports execution times longer than 10 minutes (up to 24 hours), and scales down to zero instances when idle, incurring no billing costs during idle periods.

Step-by-Step Solution

1
Analyze execution duration and packaging requirements
The workload is packaged as a Linux container and takes 12 minutes to run.
This rules out hosting options with strict timeout limitations below 12 minutes.
2
Evaluate scale-to-zero and idle cost requirements
The hosting option must scale to zero and incur zero compute charges when idle.
This rules out plans that charge for pre-warmed or running instances when idle.
3
Select the service that meets all constraints
Azure Container Apps event-driven jobs meets all requirements.
It runs containerized tasks, supports executions exceeding 10 minutes, and scales to zero with zero idle cost.

Key Concept

Selecting serverless hosting options based on execution limits, packaging, and scale-to-zero capabilities.
Question 146Question →

Apex Manufacturing is designing the network security for a three-tier application deployed in Azure. The application's virtual machines are located in a subnet named AppSubnet within a virtual network named VNet1. The virtual machines must access an Azure Key Vault and an Azure SQL Database. You need to design the outbound security rules in the Network Security Group (NSG) associated with AppSubnet. The solution must meet the following requirements:
- Allow outbound traffic to Azure Key Vault and Azure SQL Database.
- Block all other outbound traffic to the public internet.
- Minimize administrative effort by avoiding the maintenance of explicit IP address ranges in the security rules.

Which two security rules should you configure in the NSG to allow the required outbound traffic?

Select all that apply

Show answer & explanation

Answer: An outbound security rule that allows traffic with the destination set to the AzureKeyVault service tag.; An outbound security rule that allows traffic with the destination set to the Sql service tag.

Answer

To allow the required outbound traffic while minimizing administrative effort, you must configure two outbound rules in the NSG: one allowing traffic to the AzureKeyVault service tag and another allowing traffic to the Sql service tag.
The correct solution uses the AzureKeyVault and Sql service tags as destinations in the outbound NSG rules. Service tags represent a group of IP address prefixes managed by Microsoft, satisfying the requirement to minimize administrative effort and avoid manual IP tracking. They allow traffic only to those specific Azure services, satisfying the security requirements.

Step-by-Step Solution

1
Identify the target Azure services requiring outbound connectivity.
The target services are Azure Key Vault and Azure SQL Database.
This determines which service tags or destination endpoints are needed.
2
Select the configuration method that minimizes administrative effort.
Service tags (AzureKeyVault and Sql) are selected instead of explicit public IP address ranges.
Service tags represent a group of IP address prefixes from a given Azure service and are managed automatically by Microsoft, reducing overhead.
3
Create the NSG rules for the AppSubnet.
Two allow rules are created: one with the AzureKeyVault service tag as the destination, and another with the Sql service tag as the destination.
This permits the required traffic while enabling a final deny rule for the Internet service tag to block all other public outbound traffic.

Key Concept

Using Network Security Group (NSG) Service Tags to secure outbound connectivity to Azure services.
Question 147Question →

A financial services company is planning the migration of its portfolio management system from an on-premises VMware vSphere environment to Azure. The system consists of three web servers, four application servers, and a backend SQL Server 2019 instance. The SQL Server instance hosts three databases that perform cross-database queries and run several SQL Server Agent jobs. The application servers connect to external financial data feeds over non-standard TCP ports, but the port numbers and destinations are undocumented.

You need to recommend a migration assessment and target architecture design that minimizes operational effort and ensures application dependencies are fully mapped before migration.

Which combination of Azure Migrate dependency analysis and Azure SQL deployment option should you recommend?

Show answer & explanation

Answer: Azure Migrate agentless dependency analysis for the virtual machines, and Azure SQL Managed Instance for the database tier.

Answer

Azure Migrate agentless dependency analysis for the virtual machines, and Azure SQL Managed Instance for the database tier.
The correct recommendation is agentless dependency analysis for the VMware VMs combined with Azure SQL Managed Instance for the databases. Agentless dependency analysis allows mapping TCP connections directly through the Azure Migrate appliance without deploying software agents to the guest operating systems, meeting the requirement to minimize operational overhead. Azure SQL Managed Instance natively supports SQL Server Agent jobs and cross-database queries, which are critical requirements for the backend database tier.

Step-by-Step Solution

1
Analyze database requirements
Identified requirements for cross-database queries and SQL Server Agent jobs.
These are instance-level SQL Server features not supported by default in Azure SQL Database, pointing to Azure SQL Managed Instance as the correct target.
2
Analyze dependency assessment requirements
Identified the need to map undocumented TCP connections while minimizing operational effort on VMware VMs.
Azure Migrate agentless dependency analysis allows connection mapping without installing guest agents, matching the operational efficiency goal.
3
Combine the optimal components
Select agentless dependency analysis paired with Azure SQL Managed Instance.
This combination successfully meets all application requirements and administrative constraints.

Key Concept

Selecting appropriate database migration targets and dependency assessment methods based on features and operational constraints.
Question 148Question →

An enterprise is designing a high-throughput gaming backend in Azure. The backend consists of two main workloads:

1. A game-session matchmaking service that communicates over secure HTTP/S on port 443443, requiring SSL/TLS termination, URL path-based routing (e.g., routing `/match/*` to a specific pool), and SQL injection protection. This service is hosted on Azure Virtual Machines.
2. A real-time game telemetry receiver that processes high-frequency custom TCP packets on port 90009000. This receiver is deployed on a separate group of Azure Virtual Machines. The VMs hosting the telemetry receiver are pre-configured with Basic SKU public IP addresses on their network interfaces to allow direct, un-load-balanced administrator access for debugging.

The solution must meet the following requirements:
- Use a single, public entry point for the matchmaking service that is highly secure and supports path-based routing.
- Load-balance the telemetry receiver traffic across the telemetry VMs while ensuring that the current debugging configuration using Basic SKU public IPs remains functional.
- Avoid configuration validation errors due to SKU mismatches.

Which two actions should you perform to implement the load balancing architecture? (Select two.)

Select all that apply

Show answer & explanation

Answer: Deploy an Azure Application Gateway v2 with a Standard SKU public IP address to load-balance the matchmaking service.; Deploy a Basic Load Balancer to load-balance the telemetry receiver traffic on port 90009000.

Answer

Deploy an Azure Application Gateway v2 with a Standard SKU public IP address to load-balance the matchmaking service, and deploy a Basic Load Balancer to load-balance the telemetry receiver traffic on port 90009000.
Deploying an Azure Application Gateway v2 with a Standard SKU public IP successfully fulfills the Layer 7 matchmaking service needs, including WAF protection and path-based routing. Deploying a Basic Load Balancer satisfies the Layer 4 TCP requirement for the telemetry receiver while accommodating the legacy Basic SKU public IPs on the backend VMs, avoiding SKU mismatch validation errors.

Step-by-Step Solution

1
Analyze matchmaking service requirements
Identify that Layer 7 routing, SSL/TLS termination, and WAF protection are required, pointing to Azure Application Gateway v2 with a Standard SKU public IP.
Application Gateway v2 operates at Layer 7 and integrates WAF features, but strictly requires Standard SKU public IPs.
2
Analyze telemetry receiver requirements and constraints
Identify that Layer 4 TCP load balancing is required, and the target VMs must retain their Basic SKU public IPs.
The custom protocol runs on TCP port 90009000, necessitating a Layer 4 load balancer.
3
Evaluate SKU compatibility for the telemetry receiver load balancer
Determine that a Standard Load Balancer cannot be used because it is incompatible with backend VMs that have Basic SKU public IPs on their NICs, meaning a Basic Load Balancer is the correct choice.
Mixing Standard Load Balancer with Basic SKU public IP configurations on VM network interfaces leads to deployment validation errors.

Key Concept

Azure load balancing SKU constraints and Layer 4 vs Layer 7 load balancer capabilities
Estimated Time:2m 30s
Question 149Question →

Aventis Pharmaceuticals is designing a secure network architecture in Azure. The architecture includes a virtual network named VNet1 with a subnet named ProcessingSubnet. Virtual machines (VMs) in ProcessingSubnet must write processed data to an Azure Storage account in the same region. You need to recommend the outbound traffic security configuration for ProcessingSubnet that permits communication with the Azure Storage account while minimizing administrative effort when Azure Storage IP addresses change. Which configuration should you recommend?

Show answer & explanation

Answer: Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to the Storage Service Tag.

Answer

Configure an outbound security rule in the Network Security Group (NSG) associated with ProcessingSubnet, setting the destination to the Storage Service Tag.
Configuring an outbound security rule in the Network Security Group (NSG) with the destination set to the Storage Service Tag allows direct communication with Azure Storage. Microsoft automatically updates the underlying IP addresses for the Service Tag, which fulfills the requirement to minimize administrative effort.

Step-by-Step Solution

1
Identify the requirement to minimize administrative effort during IP address changes for Azure Storage.
Determine that Service Tags are the standard Azure mechanism for grouping IP addresses of specific services.
Microsoft automatically updates the IP addresses within a Service Tag, removing the administrative burden of manual updates.
2
Evaluate the use of Network Security Groups (NSGs) for traffic filtering.
An NSG rule with the Storage Service Tag as the destination allows outbound traffic to Azure Storage.
NSGs process outbound rules based on destination prefixes, and using a Service Tag matches all Storage endpoints in the region.
3
Discard options that introduce routing conflicts or SKU mismatches.
Avoid User Defined Routes that alter local system routes and avoid mixing Basic and Standard Load Balancer SKUs.
Overlapping routes disrupt local VNet traffic, and SKU mismatches cause deployment validation failures.

Key Concept

Using NSG Service Tags to filter outbound traffic to Azure services with minimal administrative effort
Estimated Time:1m 30s
Question 150Question →

A logistics company is designing an Azure compute virtualization solution for its fleet management platform. The platform has two main requirements:

1. A core telemetry ingestion engine that runs continuously, requires consistent performance, must achieve a 99.99%99.99\% availability SLA, and requires memory-optimized virtual machines.
2. A daily route-optimization analysis job that runs for approximately 44 hours, is tolerant to interruptions, and should be implemented with the lowest possible cost.

Which two compute configurations should you include in the design?

Select all that apply

Show answer & explanation

Answer: Azure Reserved Virtual Machines using Esv5-series VMs distributed across multiple Availability Zones for the telemetry ingestion engine; Azure Spot Virtual Machines using Fsv2-series VMs for the route-optimization analysis job

Answer

The correct configurations are to use Azure Reserved Virtual Machines using Esv5-series VMs distributed across multiple Availability Zones for the telemetry ingestion engine, and Azure Spot Virtual Machines using Fsv2-series VMs for the route-optimization analysis job.
The correct configurations combine Azure Reserved Virtual Machines using Esv5-series VMs distributed across multiple Availability Zones for the telemetry ingestion engine with Azure Spot Virtual Machines using Fsv2-series VMs for the route-optimization analysis job. The telemetry engine is a continuous, steady-state workload requiring a memory-optimized series and a high SLA (99.99%99.99\%), which is achieved by deploying across multiple Availability Zones. Reserved instances reduce cost for this continuous running resource. The route-optimization job runs for a short duration and can tolerate interruptions, making Spot VMs the most cost-effective option.

Step-by-Step Solution

1
Analyze the requirements for the telemetry ingestion engine.
The engine is a steady-state workload requiring continuous performance, a memory-optimized profile, and high availability (99.99%99.99\% SLA).
This establishes that we need a memory-optimized VM series (like Esv5-series) deployed in a zone-redundant configuration with a purchasing model suitable for continuous operations (like Reserved Instances to minimize cost).
2
Analyze the requirements for the route-optimization analysis job.
The job runs for 44 hours daily, is compute-intensive, can tolerate interruptions, and needs the lowest cost.
This indicates that Spot VMs (which provide deep discounts for interruptible workloads) paired with a compute-optimized VM series (like Fsv2-series) are the best fit.
3
Evaluate the distractors against these requirements.
Using Spot VMs for the telemetry engine risks eviction and violates the SLA. Deploying the telemetry engine in a single Availability Zone lacks redundancy. Azure Functions Consumption plan times out after 1010 minutes, failing the 4-hour runtime requirement.
This confirms that only the selected options meet all performance, SLA, and duration constraints.

Key Concept

Selecting Azure VM series, purchasing models, and redundancy strategies based on SLA, duration, performance, and cost constraints.
Question 151Question →

A financial services company is designing a serverless backend for an automated risk assessment platform. The platform requires two distinct processing workloads:

1. A customer risk scoring API that receives payload data, performs quick database lookups, and returns results in under 5 seconds. The API experiences unpredictable traffic spikes but must maintain sub-second response times by minimizing cold starts, and it must securely access a backend database using virtual network integration.
2. A nightly portfolio simulation engine that runs complex Monte Carlo simulations. Each simulation run takes approximately 25 minutes to execute, requires 4 vCPUs and 16 GB of memory, and must run on demand using containerized workloads without maintaining active server infrastructure or incurring significant operational management overhead when idle.

Which two Azure solutions should you recommend to host these workloads? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Functions on a Premium plan to host the customer risk scoring API.; Azure Container Apps Jobs to run the portfolio simulation engine.

Answer

Azure Functions on a Premium plan to host the customer risk scoring API, and Azure Container Apps Jobs to run the portfolio simulation engine.
The correct architecture uses Azure Functions on a Premium plan for the API because it supports pre-warmed instances to mitigate cold starts and supports regional virtual network integration. It uses Azure Container Apps Jobs for the simulation engine because Container Apps Jobs run containerized tasks to completion, allow custom CPU/memory shapes, run for durations exceeding 10 minutes (up to 24 hours), and scale to zero without the management overhead of an AKS cluster.

Step-by-Step Solution

1
Evaluate the customer risk scoring API requirements.
The API requires rapid scaling, minimized cold starts (pre-warmed instances), and outbound virtual network integration.
Azure Functions on a Premium plan satisfies all these criteria while maintaining a serverless model.
2
Evaluate the portfolio simulation engine requirements.
The engine needs to run containerized simulations for 25 minutes with specific resource allocations (4 vCPUs and 16 GB memory) and scale to zero without high management overhead.
Azure Container Apps Jobs run containerized workloads to completion, support execution times up to 24 hours, allow custom CPU/memory shapes, and scale to zero without the overhead of AKS.

Key Concept

Selecting appropriate serverless hosting plans and container services based on execution timeouts, resource requirements, virtual network integration, and operational overhead.
Question 152Question →

An international financial services firm plans to transition its on-premises customer portal to Microsoft Azure. The portal is hosted on VMware vSphere 7.0 virtual machines. The underlying database runs on Microsoft SQL Server 2022 and relies heavily on cross-database queries and several SQL Server Agent jobs. To comply with the firm's strict security regulations: 1. No software agents may be installed on any production virtual machines at any stage of the assessment or discovery process. 2. Synchronized user credentials must not leave the on-premises boundary, meaning no password hashes (even encrypted) can be synchronized to the cloud. 3. The deployment of complex on-premises federation infrastructures, such as Active Directory Federation Services (AD FS), is strictly prohibited. Which combination of dependency assessment strategy, database migration target, and hybrid identity synchronization mechanism should you recommend?

Show answer & explanation

Answer: Agentless dependency analysis, Azure SQL Managed Instance, and Pass-through Authentication (PTA)

Answer

The correct recommendation is agentless dependency analysis, Azure SQL Managed Instance, and Pass-through Authentication (PTA).
The correct recommendation is agentless dependency analysis, Azure SQL Managed Instance, and Pass-through Authentication (PTA). This option meets all technical and organizational constraints: agentless dependency mapping is native to Azure Migrate for VMware VMs and requires no agent installations; Azure SQL Managed Instance provides compatibility with SQL Server Agent jobs and cross-database queries; and Pass-through Authentication provides hybrid sign-in without uploading password hashes to the cloud or requiring complex Active Directory Federation Services (AD FS) deployments.

Step-by-Step Solution

1
Determine the appropriate dependency assessment mechanism based on VM agent restrictions.
Since the source VMs run on VMware vSphere and agents are forbidden, agentless dependency analysis via Azure Migrate is the only compliant option.
Agent-based dependency analysis requires deploying the Dependency Agent and Log Analytics Agent, which violates the security constraint.
2
Evaluate the database tier requirements against Azure SQL options.
Azure SQL Managed Instance is chosen as the target database tier.
The database uses cross-database queries and SQL Server Agent jobs, which are not supported in Azure SQL Database but are fully supported in Azure SQL Managed Instance.
3
Identify the hybrid identity integration solution matching the security and infrastructure guidelines.
Pass-through Authentication (PTA) is selected.
PTA validates passwords directly on-premises without storing password hashes in Entra ID (satisfying the security rule), and it does not require deploying AD FS servers (satisfying the simplicity rule).

Key Concept

Mapping multi-dimensional constraints (agentless discovery, legacy SQL engine features, and zero-cloud-password-hash storage rules) to compatible Azure assessment, database, and identity solutions.
Estimated Time:2m 30s
Question 153Question →

An enterprise is designing a hybrid networking solution in Azure. The architecture includes:
- A hub virtual network named `vnet-hub-eus` (10.150.0.0/1610.150.0.0/16) that hosts a Virtual Network Gateway connected to an on-premises network.
- A spoke virtual network named `vnet-prod-eus` (10.160.0.0/1610.160.0.0/16) containing two subnets: `subnet-web` (10.160.1.0/2410.160.1.0/24) and `subnet-app` (10.160.2.0/2410.160.2.0/24).
- Virtual network peering configured between `vnet-hub-eus` and `vnet-prod-eus` with gateway transit enabled.

The enterprise has the following requirements:
- All outbound internet traffic from `vnet-prod-eus` must be redirected through the Virtual Network Gateway to the on-premises firewall for inspection.
- All traffic between `subnet-web` and `subnet-app` must route directly between the subnets and must not traverse the gateway or on-premises network.

You need to design a routing solution using a custom Route Table associated with both subnets in `vnet-prod-eus`.
Which route configuration should you specify in the Route Table?

Show answer & explanation

Answer: A route for 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual network gateway.

Answer

A route for 0.0.0.0/00.0.0.0/0 with the next hop type set to Virtual network gateway.
Defining only a default route (0.0.0.0/00.0.0.0/0) pointing to the Virtual Network Gateway implements forced tunneling for all internet-destined traffic. Under Azure's longest prefix match algorithm, the system route for local VNet traffic (10.160.0.0/1610.160.0.0/16 with next hop 'Local') is more specific than the default route (0.0.0.0/00.0.0.0/0). Therefore, traffic between local subnets continues to route directly within the VNet without traversing the gateway, perfectly satisfying all requirements.

Step-by-Step Solution

1
Analyze Azure's default routing behavior for virtual networks.
By default, Azure creates system routes for local virtual network communication (such as 10.160.0.0/1610.160.0.0/16 to next hop Local) and direct internet access (0.0.0.0/00.0.0.0/0 to next hop Internet).
Understanding system routes is necessary to determine what custom routes (User-Defined Routes) must be added and what system routes should be left unchanged.
2
Address the forced tunneling requirement for outbound internet traffic.
A custom route for 0.0.0.0/00.0.0.0/0 (the default route representing all internet-bound traffic) is added to the Route Table with the next hop set to Virtual network gateway.
This route overrides the default system route for internet traffic, redirecting it to the gateway and onward to the on-premises firewall.
3
Evaluate the routing behavior for local traffic between the web and application subnets under the new Route Table configuration.
Local traffic destined for the 10.160.0.0/1610.160.0.0/16 address space will match the default system route (10.160.0.0/1610.160.0.0/16 -> Local) because its prefix length is longer and more specific than the default route prefix (0.0.0.0/00.0.0.0/0).
Since the system route for local traffic is more specific, adding no additional routes for the local VNet prefix ensures local traffic continues to flow directly between subnets without traversing the gateway.

Key Concept

Azure Longest Prefix Match (LPM) routing algorithm and User-Defined Route (UDR) precedence over system routes.
Estimated Time:1m 30s
Question 154Question →

An enterprise is designing a regional application architecture in the East US region. The application consists of two tiers:

- A web tier hosted on Azure Virtual Machines that requires SSL/TLS termination, URL path-based routing, and HTTP/S load balancing.
- A database tier hosted on Azure Virtual Machines that requires internal TCP load balancing.

All virtual machines in the database tier currently have Basic SKU Public IP addresses assigned.

You need to recommend the load balancing services and the required configuration changes to support this architecture. Which two actions should you recommend?

Select all that apply

Show answer & explanation

Answer: Deploy Azure Application Gateway to load balance the web tier.; Deploy a Standard Azure Load Balancer to load balance the database tier, and upgrade the database virtual machines' Public IP addresses to Standard SKU.

Answer

To support this architecture, you should deploy Azure Application Gateway to load balance the web tier, and deploy a Standard Azure Load Balancer to load balance the database tier while upgrading the database virtual machines' Public IP addresses to Standard SKU.
Deploying Azure Application Gateway satisfies the Layer 7 requirements (SSL/TLS termination and URL path-based routing) for the web tier. Deploying a Standard Azure Load Balancer meets the database tier's Layer 4 TCP load balancing needs, and upgrading the virtual machines' Public IPs to the Standard SKU ensures SKU compatibility and avoids validation errors.

Step-by-Step Solution

1
Determine the requirements for the web tier.
The web tier requires URL path-based routing and SSL/TLS termination, which are Layer 7 features. Azure Application Gateway is the appropriate regional load balancer for these capabilities.
Layer 4 load balancers like Azure Load Balancer cannot perform content routing or SSL/TLS offloading.
2
Determine the load balancing requirements for the database tier.
The database tier requires internal TCP load balancing, which is a Layer 4 capability. A Standard Azure Load Balancer is suitable for this regional backend traffic.
Standard Azure Load Balancer provides low-latency Layer 4 distribution.
3
Evaluate SKU compatibility constraints for the database tier.
Because the virtual machines currently use Basic SKU Public IPs, they cannot be added to the backend pool of a Standard Load Balancer. They must be upgraded to Standard SKU Public IPs.
Azure enforces SKU consistency within the load balancer configurations; mixing Basic and Standard SKUs results in configuration failures.

Key Concept

Choosing load balancing services based on OSI layer capabilities and ensuring matching resource SKUs to avoid validation errors.
Question 155Question →

An enterprise plans to migrate an on-premises multi-tier application to Azure. The application consists of 15 physical Linux (RHEL) servers running web and application services, and a backend PostgreSQL database cluster running on two physical Linux servers. The database architecture relies on cross-database queries.

You need to design a migration assessment and identity transition strategy that meets the following requirements:
- Discovers the servers and maps network connections between them to identify dependencies.
- Recommends the appropriate Azure target service for the database.
- Syncs on-premises Active Directory Domain Services (AD DS) user accounts to Microsoft Entra ID with the least administrative complexity.

Which two actions should you include in the assessment and transition strategy? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Deploy the Azure Migrate appliance on an on-premises server to discover the servers and perform agentless dependency analysis.; Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) to sync on-premises user accounts.

Answer

Deploy the Azure Migrate appliance on-premises to discover servers and perform agentless dependency analysis, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS) to sync user accounts.
Deploying the Azure Migrate appliance on-premises enables the discovery of physical Linux servers and maps their network connections agentlessly to identify server dependencies. To synchronize on-premises Active Directory accounts with the least administrative complexity, Microsoft Entra Connect with Password Hash Synchronization (PHS) is the ideal solution as it does not require additional on-premises identity federation infrastructure.

Step-by-Step Solution

1
Select the dependency analysis method
Implement the Azure Migrate appliance to perform agentless dependency analysis on the physical Linux servers.
Allows mapping of network connections between physical servers to create accurate migration groups without installing agents.
2
Select the identity sync mechanism
Choose Microsoft Entra Connect with Password Hash Synchronization (PHS).
Provides the lowest administrative overhead and complexity for syncing hybrid identities compared to federated options.

Key Concept

Selecting appropriate migration discovery and dependency tools alongside a low-overhead hybrid identity sync mechanism.
Question 156Question →

A company plans to migrate an on-premises payroll application running on physical servers to Azure. The application relies on a local Microsoft SQL Server database that utilizes SQL Server Agent jobs for nightly processing and performs cross-database queries. The company also needs to synchronize their on-premises Active Directory Domain Services (AD DS) identities to Microsoft Entra ID. The migration strategy must minimize administrative and infrastructure overhead, maintain application compatibility, and ensure that all server connections are identified before migration.

Which migration and identity synchronization strategy should you recommend?

Show answer & explanation

Answer: Migrate the database to Azure SQL Managed Instance, perform an agentless dependency analysis using Azure Migrate, and configure Microsoft Entra Connect with Password Hash Synchronization.

Answer

Migrate the database to Azure SQL Managed Instance, perform an agentless dependency analysis using Azure Migrate, and configure Microsoft Entra Connect with Password Hash Synchronization.
The correct strategy migrates the database to Azure SQL Managed Instance because it supports instance-level features like SQL Server Agent and cross-database queries. It uses Azure Migrate dependency analysis to ensure all connection vectors are verified before server migration. It utilizes Password Hash Synchronization (PHS) to sync identities with the least administrative and on-premises infrastructure overhead.

Step-by-Step Solution

1
Select the database migration target based on application features.
Choose Azure SQL Managed Instance.
The database relies on SQL Server Agent jobs and cross-database queries, which are fully supported natively on Azure SQL Managed Instance but restricted or unsupported on Azure SQL Database single databases.
2
Plan the network and server dependency assessment.
Perform dependency analysis using Azure Migrate.
A dependency analysis identifies all inbound and outbound server connections, ensuring no critical integrations are missed or broken during the migration of physical workloads.
3
Select the hybrid identity synchronization mechanism.
Configure Password Hash Synchronization (PHS) using Microsoft Entra Connect.
PHS requires the least amount of administrative and on-premises infrastructure overhead compared to Active Directory Federation Services (AD FS), satisfying the requirement to minimize operational overhead.

Key Concept

Selecting SQL database deployment tiers, dependency assessment methods, and hybrid identity architectures based on legacy application requirements and operational constraints.
Estimated Time:1m 30s
Question 157Question →

An organization plans to migrate an on-premises line-of-business application to Azure. The application currently runs on a cluster of VMware vSphere virtual machines (VMs) and connects to a Microsoft SQL Server database cluster. The database relies on SQL Server Agent jobs and performs cross-database queries. The organization needs to discover server dependencies, analyze database compatibility with Azure SQL deployment options, and plan the migration strategy. Which two actions should you include in the migration assessment strategy? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Deploy the Azure Migrate appliance in the VMware environment to perform discovery and enable agentless dependency mapping.; Run the Azure Migrate database assessment to evaluate compatibility and target sizing for Azure SQL Managed Instance.

Answer

The correct actions are deploying the Azure Migrate appliance to perform agentless dependency mapping and running the Azure Migrate database assessment to evaluate compatibility with Azure SQL Managed Instance.
Deploying the Azure Migrate appliance for agentless dependency mapping allows for the discovery and visualization of network dependencies between virtual machines, ensuring that all components of the application are migrated together. Running the database assessment specifically for Azure SQL Managed Instance evaluates compatibility and sizing for a target that supports the on-premises database's SQL Server Agent and cross-database queries.

Step-by-Step Solution

1
Identify the migration requirements and technical constraints for the databases and applications.
The application relies on SQL Server features including SQL Server Agent and cross-database queries, which require Azure SQL Managed Instance rather than Azure SQL Database single database.
Choosing the wrong database target tier causes migration compatibility issues and application failure.
2
Select the appropriate tools to assess dependencies and database readiness.
Deploying the Azure Migrate appliance enables discovery and agentless dependency mapping. Evaluating database compatibility with Azure Migrate database assessment checks for SQL Managed Instance compatibility.
Dependency analysis ensures grouped workloads are migrated together to prevent latency, and database assessment validates feature support before migration.

Key Concept

Azure Migrate assessment strategy involves using the Azure Migrate appliance for VM discovery and dependency mapping, combined with database compatibility analysis to align database features (e.g., cross-database queries, SQL Server Agent) with the correct target tier (Azure SQL Managed Instance).
Estimated Time:2m 0s
Question 158Question →

You are designing a serverless container solution on Azure. The solution must host microservices with zero cluster management overhead and scale containers automatically based on the number of messages in an Azure Service Bus queue. Which two configurations or services should you recommend?

Select all that apply

Show answer & explanation

Answer: Azure Container Apps to host the microservices; Kubernetes Event-driven Autoscaling (KEDA) scale rules configured on the container app

Answer

Azure Container Apps to host the microservices and Kubernetes Event-driven Autoscaling (KEDA) scale rules configured on the container app
The correct options are to use the serverless hosting platform designed for microservices and its built-in event-driven scaling configuration. Azure Container Apps hosts the microservices without cluster management, and native KEDA integration enables scaling to zero and up based on Service Bus queue depth.

Step-by-Step Solution

1
Analyze the requirements for host architecture.
Identify that serverless container hosting is required to achieve zero cluster management overhead.
Azure Container Apps is Microsoft's recommended serverless platform for microservices when cluster-level administration is not needed.
2
Evaluate the autoscaling requirement.
Identify that event-driven scaling based on queue messages is supported natively through KEDA scale rules.
Azure Container Apps utilizes integrated KEDA for scaling rules based on HTTP traffic, CPU/Memory, or event sources like Azure Service Bus.

Key Concept

Selecting serverless container services and event-driven scaling mechanisms in Azure to minimize operational overhead
Estimated Time:1m 0s
Question 159Question →

You are designing the infrastructure for a database synchronization tool that runs as an Azure Function. The tool is triggered by a webhook and runs for up to 15 minutes per invocation. Which two Azure hosting options should you recommend to support this execution duration while minimizing operational overhead? (Select two.)

Select all that apply

Show answer & explanation

Answer: Azure Functions Premium plan; Azure Functions Dedicated (App Service) plan

Answer

The Azure Functions Premium plan and the Azure Functions Dedicated (App Service) plan are the correct choices because they support execution times longer than 10 minutes while avoiding the high administrative overhead of Azure Kubernetes Service.
The Azure Functions Premium plan and the Azure Functions Dedicated (App Service) plan both support execution durations longer than 10 minutes, making them suitable for the 15-minute runtime of the synchronization tool. They also maintain a low operational overhead, aligning with the requirement to minimize management effort.

Step-by-Step Solution

1
Analyze the execution duration requirement of the workload.
The workload runs for up to 15 minutes per invocation.
This duration exceeds the 10-minute maximum execution limit of the Azure Functions Consumption plan.
2
Evaluate the remaining Azure Functions hosting plans for duration limits.
Both the Premium plan and Dedicated (App Service) plan support execution durations of 15 minutes or longer (Premium is default 30 minutes / unbounded; Dedicated is unbounded).
These plans prevent timeout errors for workloads exceeding 10 minutes.
3
Evaluate alternative hosting options like Azure Kubernetes Service (AKS) against operational requirements.
AKS supports long execution times but introduces high operational overhead for setup, maintenance, and scaling of a cluster.
For a simple database synchronization tool, Azure Functions provides a much simpler management model than AKS.

Key Concept

Selecting appropriate Azure serverless hosting plans based on execution duration limits and operational complexity.
Question 160Question →

A logistics company is modernizing a web-based vehicle tracking API hosted on a pool of Azure Virtual Machines in a single region. The API requires SSL/TLS termination and URL path-based routing to direct traffic to different backend pools. The virtual machines are currently configured with Basic SKU Public IP addresses for management. You need to recommend a regional load balancing solution that meets these requirements. Which Azure service should you select?

Show answer & explanation

Answer: Azure Application Gateway (Standard v2)

Answer

Azure Application Gateway (Standard v2) is the correct service because it provides Layer 7 load balancing features, including SSL/TLS termination and URL path-based routing, within a single region. Because it routes traffic to the backend using private IP addresses, it does not conflict with the existing Basic SKU Public IP configurations on the backend virtual machines.
Azure Application Gateway (Standard v2) is designed for regional Layer 7 load balancing. It natively supports SSL/TLS termination and URL path-based routing. Since it forwards traffic to backend VMs via private IP addresses, the SKU of the virtual machines' public IPs does not impact its deployment.

Step-by-Step Solution

1
Analyze protocol and routing requirements.
The application is web-based, requiring Layer 7 features (SSL/TLS termination and URL path-based routing).
This rules out Layer 4 solutions like Azure Load Balancer.
2
Determine the geographic scope of the load balancer.
The workload is located in a single region.
This makes regional load balancers like Azure Application Gateway preferred over global services like Azure Front Door or Azure Traffic Manager.
3
Verify SKU compatibility with existing virtual machine configurations.
Backend virtual machines have Basic SKU Public IPs, which cannot be mixed with a Standard Load Balancer backend pool. However, Azure Application Gateway operates via private IPs and does not trigger this SKU mismatch.
Ensures the selected architecture is valid and will not fail deployment.

Key Concept

Azure Application Gateway is a regional Layer 7 load balancer that supports SSL/TLS termination and URL path-based routing, and it avoids the Basic/Standard SKU mismatch constraint because it routes traffic over private IPs.
PreviousPage 8 / 18Next
Design Infrastructure Solutions Practice Questions — Microsoft Azure Solutions Architect (AZ-305) — Page 8 | Examkin