Tüm alıştırma soruları

1198 soru

Soru 341Soru

A logistics company, SwiftRoute Deliveries, is designing a disaster recovery plan for its package tracking data stored in Azure Blob Storage. The solution must meet the following requirements:
- The tracking data must remain readable even if the primary Azure region experiences a complete regional outage.
- Users must be able to read data from the secondary region at any time without initiating a storage account failover.
- Storage costs must be minimized.

Which two configuration steps should you recommend? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the storage account to use Read-access geo-redundant storage (RA-GRS).; Configure the client application to direct read operations to the secondary endpoint if the primary endpoint is unavailable.

Cevap

Configure the storage account to use Read-access geo-redundant storage (RA-GRS) and configure the client application to direct read operations to the secondary endpoint if the primary endpoint is unavailable.
To meet the requirements, you must configure the storage account to use Read-access geo-redundant storage (RA-GRS) because it replicates data across regions and provides a read-only endpoint in the secondary region. Additionally, the client application must be configured to handle read failures by targeting the secondary read endpoint. This allows users to read tracking data even during a primary region outage without requiring a storage account failover.

Adım Adım Çözüm

1
Analyze the read availability requirement during a primary region outage without failover.
Read-access geo-redundant storage (RA-GRS) must be selected because it replicates data to a secondary region and provides a secondary read-only endpoint.
Standard Geo-redundant storage (GRS) replicates data but does not expose a read-only endpoint in the secondary region unless a failover is triggered.
2
Determine how the client application should access the secondary region.
The client application must be configured to query the secondary read-only endpoint if the primary endpoint fails.
This allows the application to remain available for read queries during a primary region outage without requiring administrative failover.

Anahtar Kavram

Read-access geo-redundant storage (RA-GRS) replication and client-side read routing to the secondary storage endpoint.
Soru 342Soru

An enterprise is designing a disaster recovery (DR) solution from the East US region to the West US region for a critical retail application. The source environment consists of the following Azure Virtual Machines:
- `web-vm1`: A web server VM with 22 Premium SSD v1 disks. Each disk has a write churn rate of 4 MB/s4\text{ MB/s}, resulting in a total VM write churn of 8 MB/s8\text{ MB/s}.
- `db-vm1`: A database server VM running SQL Server on Azure VMs. It has 33 Premium SSD v1 disks: one OS disk with a write churn of 2 MB/s2\text{ MB/s}, one database data disk with a write churn of 12 MB/s12\text{ MB/s}, and one transaction log disk with a write churn of 28 MB/s28\text{ MB/s}.

The DR design must meet the following business continuity requirements:
- The web server must achieve a Recovery Point Objective (RPO) of under 4 hours4\text{ hours} and a Recovery Time Objective (RTO) of under 2 hours2\text{ hours}.
- The database server must achieve an RPO of under 10 seconds10\text{ seconds} and an RTO of under 15 minutes15\text{ minutes} during a regional outage.

Which recovery design should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Replicate `web-vm1` using Azure Site Recovery. For `db-vm1`, deploy a secondary SQL Server virtual machine in the West US region and configure SQL Server Always On Availability Groups with asynchronous commit replication.

Cevap

The correct design is to replicate the web server using Azure Site Recovery and to configure SQL Server Always On Availability Groups with asynchronous commit replication for the database server.
The web server's write churn (4 MB/s4\text{ MB/s} per disk, 8 MB/s8\text{ MB/s} total) is well within the standard limits of Azure Site Recovery, making it suitable for VM-level replication. However, the database server's transaction log disk has a write churn of 28 MB/s28\text{ MB/s}, which exceeds the 20 MB/s20\text{ MB/s} per-disk limit of the Azure Site Recovery high-churn replication tier. Therefore, database-level replication using SQL Server Always On Availability Groups with asynchronous commit must be designed to handle the database write churn and meet the low RPO requirement of under 10 seconds10\text{ seconds}.

Adım Adım Çözüm

1
Evaluate the write churn requirements for the VM disks against Azure Site Recovery limits.
The web server disks (4 MB/s4\text{ MB/s} each, 8 MB/s8\text{ MB/s} total) are within the standard 10 MB/s10\text{ MB/s} ASR disk limit. The database server's transaction log disk has a churn of 28 MB/s28\text{ MB/s}, which exceeds the high-churn tier limit of 20 MB/s20\text{ MB/s} per disk.
To determine if Azure Site Recovery can support the VM workload replication natively.
2
Identify alternative replication mechanisms for the database workload.
SQL Server Always On Availability Groups with asynchronous commit replication allows near-real-time data replication at the database level without being limited by block-level storage replication thresholds.
To satisfy the low RPO (<10 seconds< 10\text{ seconds}) requirement of the database tier despite the high write churn.
3
Assess the routing and database deployment constraints.
Active geo-replication does not support automatic failover with a single read-write listener endpoint, and Azure Traffic Manager cannot perform SSL offloading or path-based routing because it operates strictly at the DNS level.
To eliminate invalid architectural options that violate traffic management or database capabilities.

Anahtar Kavram

Azure Site Recovery write churn limits and database-level replication options for cross-region disaster recovery
Soru 343Soru

A healthcare company is designing a disaster recovery and high availability solution for a multi-tenant SaaS application. The application's data tier consists of 5050 databases hosted in Azure SQL Database. The databases are grouped into an elastic pool in the East US region.

The solution must meet the following requirements:
- Deliver a Recovery Time Objective (RTO) of 11 hour.
- Deliver a Recovery Point Objective (RPO) of 1010 seconds.
- Automatically route read-write application traffic to the secondary region during a regional outage.
- Route read-only reporting traffic to the secondary region without requiring modifications to the application connection strings.
- Minimize the administrative effort required to configure database replication and connection management.

Which two actions should you include in the design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an auto-failover group that includes the elastic pool, and route the application traffic using the read-write and read-only listener endpoints.; Configure the auto-failover group's read-write grace period to control the automatic failover behavior during an outage.

Cevap

Configure an auto-failover group that includes the elastic pool, routing application traffic via read-write and read-only listener endpoints, and configure the read-write grace period to control automatic failover.
The configuration utilizing an auto-failover group containing the elastic pool correctly enables the replication of all databases as a single administrative unit. It provides two distinct listener endpoints (read-write and read-only) that automatically route traffic to the appropriate primary or secondary databases without connection string changes. Setting the automatic failover policy with a grace period is correct because it controls the automated failover sequence to secondary resources within the required RTO boundary.

Adım Adım Çözüm

1
Analyze the high availability and connection requirements.
Identify that automatic failover, dedicated read-write and read-only routing, and low connection string administration are required for the 5050 databases.
This helps narrow down the database replication technology suitable for grouped databases and automatic endpoint management.
2
Evaluate replication technologies: active geo-replication versus auto-failover groups.
Select auto-failover groups because they support grouping an entire elastic pool, provide built-in listeners for automatic routing, and support automatic failover.
Active geo-replication requires manual failover and application-side connection updates, which violates the requirement of minimizing administrative effort and routing traffic automatically.
3
Configure the failover policy and parameters.
Define an automatic failover policy with an appropriate grace period matching the RTO constraints.
The grace period controls when the automatic failover of the listener endpoints is triggered, preventing premature failovers during transient outages while satisfying the RTO.

Anahtar Kavram

Azure SQL Database Auto-Failover Groups provide grouped database replication, automatic failover capabilities, and listener endpoints to automatically route read-write and read-only traffic during regional outages.
Tahmini Süre:2m 0s
Soru 344Soru

A hospitality management company is designing a privileged access strategy for managing its production Azure subscriptions. The company has 50 database administrators who need temporary, approved access to the User Access Administrator role to modify resource permissions during database migrations. The access must be limited to a maximum of 4 hours, require multi-factor authentication (MFA) upon activation, and require manual approval. To minimize administrative overhead, the security team wants to avoid managing individual role assignments in Privileged Identity Management (PIM). Which configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create a security group containing the database administrators, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM) for Azure resources.

Cevap

Create a security group containing the database administrators, and assign this group as eligible for the User Access Administrator role in Privileged Identity Management (PIM) for Azure resources.
Creating a security group containing the database administrators and assigning it to the User Access Administrator role in Privileged Identity Management (PIM) allows the security team to manage eligibility at the group level. This reduces administrative overhead while ensuring that the administrators can still request time-bound, approved access on demand.

Adım Adım Çözüm

1
Identify the requirement to minimize administrative overhead for managing 50 database administrators.
Determine that assigning roles to a group is more scalable than managing 50 individual user assignments.
Managing group membership simplifies administration and avoids creating 50 separate PIM assignments.
2
Analyze the access control constraints: temporary access, maximum of 4 hours, requiring MFA, and manual approval.
Determine that Privileged Identity Management (PIM) for Azure resources provides the necessary Just-In-Time (JIT) access control capabilities.
PIM allows users to activate eligible role assignments temporarily after fulfilling activation requirements like MFA and approvals.
3
Combine group-based management with PIM configuration to formulate the final recommendation.
Recommend creating a security group for the administrators and making that group eligible for the User Access Administrator role in PIM.
This satisfies the requirement for group-based administration and temporary, approved, and audited privilege escalation.

Anahtar Kavram

Implementing group-based eligibility in Entra ID Privileged Identity Management (PIM) to achieve scalable, time-bound, and approved access governance.
Soru 345Soru

You are designing a disaster recovery solution to Azure for an on-premises VMware virtual machine that runs a retail inventory database. The solution must use Azure Site Recovery to meet a Recovery Point Objective (RPO) of 15 minutes15\text{ minutes} and a Recovery Time Objective (RTO) of 1 hour1\text{ hour}. The virtual machine has the following disk configuration:

* Disk 1 (OS): 127 GB127\text{ GB} size, with a peak write churn of 3 MB/s3\text{ MB/s}
* Disk 2 (Data): 1 TB1\text{ TB} size, with a peak write churn of 14 MB/s14\text{ MB/s}

You need to recommend the target Azure managed disk configuration for replication while minimizing ongoing storage costs. Which configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Replicate Disk 1 to a Standard SSD managed disk and Disk 2 to a Premium SSD managed disk.

Cevap

Replicate Disk 1 to a Standard SSD managed disk and Disk 2 to a Premium SSD managed disk.
The correct configuration is to replicate Disk 1 to a Standard SSD managed disk and Disk 2 to a Premium SSD managed disk. In Azure Site Recovery replication from VMware to Azure, the maximum supported write churn per disk is 10 MB/s10\text{ MB/s} for Standard SSD and 25 MB/s25\text{ MB/s} for Premium SSD. Disk 1's peak write churn is 3 MB/s3\text{ MB/s}, which is within the Standard SSD limit and minimizes costs. Disk 2's peak write churn is 14 MB/s14\text{ MB/s}, which exceeds the Standard SSD limit and therefore requires a Premium SSD target.

Adım Adım Çözüm

1
Analyze the peak write churn for each disk against Azure Site Recovery limits for VMware to Azure replication.
Disk 1 has a peak churn of 3 MB/s3\text{ MB/s} (below the 10 MB/s10\text{ MB/s} Standard SSD limit). Disk 2 has a peak churn of 14 MB/s14\text{ MB/s} (above the 10 MB/s10\text{ MB/s} Standard SSD limit but below the 25 MB/s25\text{ MB/s} Premium SSD limit).
To identify which Azure managed disk types are technically capable of handling the write churn without replication lag or failure.
2
Apply the cost minimization constraint to the compatible disk types.
Disk 1 should be mapped to the lowest-cost capable disk type, which is Standard SSD. Disk 2 must be mapped to Premium SSD because Standard SSD cannot support its write churn.
To satisfy the requirement of minimizing ongoing storage costs while maintaining supported configurations.

Anahtar Kavram

Azure Site Recovery write churn limits for VMware to Azure replication require mapping target disk types based on peak write rate limits (10 MB/s10\text{ MB/s} for Standard HDD/SSD, and 25 MB/s25\text{ MB/s} for Premium SSD per disk).
Soru 346Soru

An international healthcare organization is designing a telemonitoring platform to ingest telemetry data from 500,000500,000 wearable medical devices globally. The platform requires a globally distributed Azure Cosmos DB for NoSQL database. The workload is write-heavy, with a write-to-read ratio of 9:19:1, and requires a 99.999%99.999\% read and write availability SLA.

The design must meet the following requirements:
- Support multi-region writes to provide sub-1010 ms write latency for patients worldwide.
- Ensure the backup data can survive a regional primary datacenter outage.
- Prevent hot partitions under heavy write load.
- Authorize external research partners to access specific patient telemetry using temporary credentials that automatically expire after 2424 hours, without exposing the database's master keys.

Which two configuration options should you include in the storage design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Partition the Cosmos DB container using a high-cardinality composite key such as deviceId-YYYYMMDD and configure the database account with Session consistency.; Deploy a custom token broker service to issue Azure Cosmos DB resource tokens with a maximum lifetime of 24 hours to the external research partners.

Cevap

Partition the Cosmos DB container using a high-cardinality composite key such as deviceId-YYYYMMDD, configure the database account with Session consistency, and deploy a custom token broker service to issue Azure Cosmos DB resource tokens with a maximum lifetime of 24 hours.
Partitioning the container using a high-cardinality composite key like deviceId-YYYYMMDD ensures that the write-heavy workload of 500,000 devices is evenly distributed across logical and physical partitions, avoiding hot partition bottlenecks. Implementing a custom token broker to issue 24-hour resource tokens satisfies the security requirement by providing temporary, fine-grained access to third-party integrations without exposing master keys.

Adım Adım Çözüm

1
Analyze partitioning requirements to prevent hot partitions.
Identify that deviceId-YYYYMMDD is a high-cardinality key that spreads the write load across partitions, whereas deviceType has low cardinality and would create hot partitions.
Choosing a high-cardinality partition key ensures high scalability and avoids RequestRateTooLarge errors in write-heavy workloads.
2
Analyze authorization requirements for external research partners.
Recommend using a custom token broker to generate short-lived (24-hour) resource tokens.
Resource tokens provide granular access permissions to specific containers or items and expire automatically without exposing the account master keys.
3
Evaluate backup redundancy and replication requirements.
Reject Locally Redundant Storage (LRS) for backups as it cannot survive regional outages.
LRS keeps three copies of data in a single datacenter, making it vulnerable to regional disaster, violating the RPO and survivability requirements.

Anahtar Kavram

Designing partition keys and security policies for Azure Cosmos DB in globally distributed scenarios.
Soru 347Soru

A retail corporation is designing a new inventory tracking system in Azure. The database layer must meet the following requirements:

* Allow queries that span multiple databases using standard three-part naming.
* Automate administrative tasks such as operating system updates and database backups.
* Provide a built-in high availability SLA without requiring manual cluster configuration.
* Support running scheduled maintenance jobs using the SQL Server Agent.

Which Azure SQL service should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance

Cevap

Azure SQL Managed Instance
Azure SQL Managed Instance is the correct choice because it combines the benefits of a fully managed Platform as a Service (PaaS) with high compatibility with the SQL Server database engine. It natively supports SQL Server Agent and cross-database queries using three-part naming, while automating operating system updates, backups, and high availability.

Adım Adım Çözüm

1
Identify the key application requirements
The requirements include SQL Server Agent, native cross-database queries (three-part naming), automated OS updates/backups, and built-in high availability.
This establishes the criteria for evaluating the Azure SQL deployment options.
2
Filter deployment options by support for SQL Server Agent and cross-database queries
Azure SQL Database (single database and elastic pools) are eliminated because they do not natively support SQL Server Agent or cross-database queries using three-part naming. Azure SQL Managed Instance and SQL Server on Azure VMs remain.
Both requirements are critical feature dependencies that must be natively supported.
3
Evaluate the remaining options against the administrative and SLA requirements
SQL Server on Azure VMs requires manual OS updates and manual HA cluster setup. Azure SQL Managed Instance is a PaaS service that automates patching, backups, and provides built-in high availability.
Choosing a fully managed PaaS solution satisfies the requirement to automate updates and minimize cluster management effort.

Anahtar Kavram

Selecting the appropriate Azure SQL deployment option based on compatibility requirements and management overhead.
Tahmini Süre:1m 30s
Soru 348Soru

A corporate client is designing the storage infrastructure for a new core banking system in Azure. The design specifies two storage accounts:

1. `recordsstore`: A General Purpose v2 storage account hosting transactional PDF statements. The statements must survive a regional disaster. The secondary region must be readable at all times to serve read-only queries from reporting systems, and the data must be resilient to zone failures within the primary region.
2. `appfiles`: A Premium file share hosting critical configuration files that require sub-millisecond latency. The share must remain available if a datacenter within the primary region fails.

Which two redundancy options should you select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Read-access geo-zone-redundant storage (RA-GZRS) for recordsstore; Zone-redundant storage (ZRS) for appfiles

Cevap

Select Read-access geo-zone-redundant storage (RA-GZRS) for recordsstore and Zone-redundant storage (ZRS) for appfiles.
The correct options are the combination of Read-access geo-zone-redundant storage (RA-GZRS) for recordsstore and Zone-redundant storage (ZRS) for appfiles. For recordsstore, RA-GZRS ensures zone-resiliency within the primary region while also providing read-access to the secondary region before failover. For appfiles, ZRS is required to survive a datacenter failure within the primary region, and it is the highest redundancy tier supported by Azure Premium Files (FileStorage accounts).

Adım Adım Çözüm

1
Analyze the resiliency and access requirements for recordsstore.
The requirements demand primary region zone resiliency (ruling out LRS and GRS), regional disaster resilience (requiring geo-replication like GRS/GZRS), and secondary region read access before failover (requiring RA- prefix).
Identifying these three constraints leads to selecting Read-access geo-zone-redundant storage (RA-GZRS).
2
Analyze the performance and availability requirements for appfiles.
The premium file share requires sub-millisecond latency (requiring Premium Files / FileStorage account) and must survive a primary region datacenter failure (requiring zone-redundancy).
Understanding the limitations of Premium Files storage accounts restricts the available redundancy configurations to LRS and ZRS.
3
Map the appfiles constraints to the supported Premium Files options.
Since only LRS and ZRS are supported for Premium Files, and the share must survive a zone failure, Zone-redundant storage (ZRS) must be selected.
This rules out LRS due to lack of zone resiliency, and rules out GZRS/GRS because they are unsupported by Premium File storage accounts.

Anahtar Kavram

Azure storage redundancy tiers and their limitations across standard and premium storage account types.
Soru 349Soru

A multinational logistics enterprise is migrating an on-premises package tracking application to Azure. The application's database layer has the following requirements:
- Must support SQL Server Agent jobs for hourly scheduled maintenance and three-part name cross-database queries.
- Must tolerate a single Availability Zone failure in the primary region with a recovery time objective (RTO) of less than 30 seconds and a recovery point objective (RPO) of zero.
- Must support disaster recovery to a paired secondary region with a regional RTO of under 20 minutes and a regional RPO of less than 5 seconds, using a single connection string that automatically redirects application traffic during failover.
- Must minimize ongoing administrative effort for database engine patching and operating system maintenance.

Which database solution should you design to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance in the Business Critical tier configured with zone redundancy in the primary region, replicated to a secondary region using an Auto-Failover Group.

Cevap

Azure SQL Managed Instance in the Business Critical tier configured with zone redundancy in the primary region, replicated to a secondary region using an Auto-Failover Group.
The correct solution uses Azure SQL Managed Instance in the Business Critical tier with zone redundancy. SQL Managed Instance provides the required compatibility features (SQL Server Agent and cross-database queries) while minimizing administrative effort as a fully managed PaaS. Enabling zone redundancy in the Business Critical tier places replicas across zones, ensuring synchronous replication (RPO of zero) and fast failovers (RTO under 30 seconds). Replicating to a secondary region using an Auto-Failover Group satisfies the RPO and RTO disaster recovery requirements, and provides a single endpoint listener to automatically route application traffic.

Adım Adım Çözüm

1
Analyze compatibility requirements.
SQL Server Agent and three-part name cross-database queries are required, which eliminates Azure SQL Database.
Azure SQL Database does not support these native SQL Server features.
2
Evaluate administrative overhead constraints.
Eliminate SQL Server on Azure VMs.
Running SQL Server on VMs requires manual patching, backups, and OS management, violating the constraint to minimize administrative effort.
3
Evaluate local high availability requirements.
Select Azure SQL Managed Instance Business Critical tier with zone redundancy enabled.
Business Critical tier uses fast Always On Availability Groups under the hood to meet RPO of zero and RTO under 30 seconds. General Purpose tier has a longer failover time (1-2 minutes) because it requires bootstrapping a new instance.
4
Evaluate disaster recovery and redirection requirements.
Implement an Auto-Failover Group to the paired secondary region.
Auto-Failover Groups support asynchronous replication (RPO under 5 seconds) and provide a single read-write listener endpoint for automatic traffic redirection during regional failover.

Anahtar Kavram

Designing high availability and disaster recovery for relational databases in Azure based on compatibility, performance, RTO/RPO, and administrative overhead.
Soru 350Soru

A media streaming company is designing a storage strategy for its video library using Azure Blob Storage. The video files are frequently watched during the first 30 days after they are uploaded. After this initial period, the files are rarely accessed, but they must remain online and accessible with sub-second latency for immediate streaming when requested. You need to define a lifecycle management policy to reduce storage costs. Which rule action should you apply to blobs that are older than 30 days?

Cevabı ve açıklamayı göster

Cevap: Move the blobs to the Cool storage tier.

Cevap

Move the blobs to the Cool storage tier.
Moving the blobs to the Cool storage tier is the correct solution because the Cool tier is designed for infrequently accessed data and provides sub-second latency. This reduces storage costs compared to the Hot tier while satisfying the requirement for immediate streaming.

Adım Adım Çözüm

1
Analyze the access pattern and latency requirements.
The video files are frequently accessed for 30 days, then rarely accessed, but must remain online with sub-second latency for immediate streaming.
This establishes that the data must stay in an online tier (Hot, Cool, or Cold) and cannot be moved to an offline tier (Archive).
2
Identify the lowest-cost online storage tier that meets the requirements.
The Cool storage tier offers lower storage costs than the Hot tier while maintaining sub-second retrieval times.
Cool tier is the optimal choice for infrequently accessed data that still requires immediate access.

Anahtar Kavram

Configuring Azure Blob Storage lifecycle management policies to transition blobs to the optimal online tier based on access frequency and latency requirements.
Soru 351Soru

An insurance firm is designing the disaster recovery architecture for its policy management application. The application uses an Azure SQL Database as its data tier. The disaster recovery solution must meet the following requirements:

* If a regional outage occurs, the database must fail over automatically to a secondary Azure region.
* The application connection strings must remain unchanged after a failover.
* The secondary replica must be used to run read-only reporting workloads, and reporting clients must automatically route to the active secondary database.

Which Azure SQL Database feature should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Failover groups

Cevap

Failover groups
Failover groups allow you to manage replication, connectivity, and failover of databases to another Azure region. It provides read-write and read-only listener endpoints that point to the primary and secondary databases. If a failover occurs, the endpoints automatically update to point to the new roles, keeping connection strings unchanged. It also supports automatic failover policies.

Adım Adım Çözüm

1
Analyze the automatic regional failover and endpoint requirements.
Determined that the solution must support automatic failover and stable, unchanged connection strings for both read-write and read-only traffic across regions.
This rules out basic active geo-replication, which requires manual failover and does not provide unified connection listeners.
2
Compare managed PaaS options against IaaS options to minimize operational overhead.
Ruled out migrating to SQL Server Always On availability groups on Azure VMs, as the application is already on Azure SQL Database and PaaS-native solutions are preferred to minimize administrative effort.
Azure SQL Database has built-in high availability and disaster recovery mechanisms.
3
Select the feature that natively provides automated failover and dual listener endpoints.
Selected Failover groups, which natively offer read-write and read-only listener endpoints to route traffic dynamically to the active primary and secondary databases.
Failover groups meet all requirements for automated failover, stable endpoints, and read-scale routing for Azure SQL Database.

Anahtar Kavram

Azure SQL Database Failover groups provide automatic failover and stable read-write/read-only listener endpoints across regions.
Soru 352Soru

An enterprise is designing a secure storage solution for archiving monthly financial audit reports in an Azure Blob Storage container. The solution must satisfy the following requirements:
- External financial auditors must be granted read access to the reports for exactly 30 days.
- The enterprise must have the ability to immediately revoke access for all auditors before the 30-day period expires without rotating the storage account access keys or impacting other applications.
- Storage administrators must manage the storage security settings by using just-in-time (JIT) access.

Which design strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments for storage administrators. Create a Microsoft Entra security group for the auditors, and generate a Shared Access Signature (SAS) token associated with a stored access policy on the container.

Cevap

Configure Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments for storage administrators. Create a Microsoft Entra security group for the auditors, and generate a Shared Access Signature (SAS) token associated with a stored access policy on the container.
The correct strategy uses eligible role assignments in Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access for storage administrators. For the external auditors, a Microsoft Entra security group reduces operational overhead compared to direct assignments. Associating the SAS token with a stored access policy enables immediate revocation of the SAS token at any time by modifying or deleting the policy, avoiding the disruption of rotating the storage account's master keys.

Adım Adım Çözüm

1
Configure JIT access for security administrators.
Administrators use Microsoft Entra Privileged Identity Management (PIM) with eligible assignments rather than permanent active access.
This implements the principle of least privilege by ensuring administrative permissions are only active when needed and require justification/approval.
2
Configure the security boundary and access method for the auditing team.
Auditors are placed in a Microsoft Entra security group, and access is granted via a Shared Access Signature (SAS) token.
Grouping users prevents the overhead of direct RBAC assignments and aligns with identity lifecycle management best practices.
3
Associate the SAS token with a Stored Access Policy (SAP).
The SAS token's permissions and lifetime (30 days) are bound to a stored access policy defined on the blob container.
An SAP allows the enterprise to instantly revoke the SAS token by deleting or modifying the policy, removing the need to rotate storage account keys.

Anahtar Kavram

Data Storage Security and Access Control
Soru 353Soru

You are designing a business continuity and backup strategy for a set of Azure Virtual Machines that host a critical ERP system.

The system has the following requirements:
- Any VM recovery for outages occurring within the last 10 days must complete in under 15 minutes.
- Backups must be retained for 3 years to comply with regulatory audits.
- The backups must remain available for restore in a secondary paired region even if the primary region experiences a prolonged outage.
- Storage cost must be minimized while meeting all recovery objectives.

Which backup configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: A Recovery Services vault configured with Geo-redundant storage (GRS) and Cross Region Restore (CRR) enabled, utilizing an Enhanced backup policy with the instant restore retention set to 10 days and vault retention set to 36 months.

Cevap

A Recovery Services vault configured with Geo-redundant storage (GRS) and Cross Region Restore (CRR) enabled, utilizing an Enhanced backup policy with the instant restore retention set to 10 days and vault retention set to 36 months.
To satisfy the RTO of 15 minutes for recoveries up to 10 days old, the solution must utilize snapshot-based instant restore. Because the Standard backup policy only supports instant restore retention of up to 5 days, an Enhanced backup policy is required to support the 10-day retention. Furthermore, to enable recovery in a secondary paired region, the vault must be configured with Geo-redundant storage (GRS) and Cross Region Restore (CRR) enabled.

Adım Adım Çözüm

1
Analyze the recovery time objective (RTO) and time window.
Recovery must occur within 15 minutes for disruptions up to 10 days old. This requires restoring from local snapshots (instant restore) rather than from the vault tier.
Vault-tier restores involve transferring data back to the disk and take significantly longer, exceeding the 15-minute RTO, whereas snapshot restores are near-instantaneous.
2
Evaluate the instant restore policy constraints in Azure Backup.
Standard backup policies restrict instant restore retention to a maximum of 5 days. Enhanced backup policies allow configuring instant restore retention between 1 and 30 days.
Since a 10-day instant restore window is required, the Enhanced backup policy must be chosen.
3
Determine the required storage redundancy for disaster recovery.
Geo-redundant storage (GRS) with Cross Region Restore (CRR) enabled is necessary to allow restores in a secondary paired region.
Locally-redundant storage (LRS) only maintains copies within the primary region and cannot support CRR.

Anahtar Kavram

Selecting and configuring the appropriate Azure VM backup policy type (Standard vs. Enhanced) and storage redundancy model based on strict RTO, retention, and disaster recovery requirements.
Tahmini Süre:2m 0s
Soru 354Soru

A company is designing a disaster recovery solution for its document management application. The architect proposes using an Azure Storage account configured with Read-Access Geo-Redundant Storage (RA-GRS). The plan assumes that the application running in the secondary region can write files directly to the secondary storage endpoint during normal operations or before a failover is initiated. Why is this design proposal incorrect?

Cevabı ve açıklamayı göster

Cevap: RA-GRS only provides read access to the secondary region; write operations cannot be performed on the secondary endpoint unless a failover is initiated.

Cevap

The option stating that RA-GRS only provides read access to the secondary region and write operations cannot be performed unless a failover is initiated is the correct answer.
The correct answer is correct because RA-GRS provides a read-only endpoint in the secondary region. During normal operations, write operations can only be sent to the primary region. Write access to the secondary region is only enabled after a failover occurs, which promotes the secondary region to the primary region.

Adım Adım Çözüm

1
Analyze the capability of Read-Access Geo-Redundant Storage (RA-GRS).
RA-GRS provides read-only access to the replicated data in the secondary region under normal operating conditions.
To understand the read/write constraints of the proposed architecture.
2
Evaluate the application write requirements.
The application requires writing directly to the secondary region storage endpoint prior to a failover.
To determine if the write operations are supported in the secondary region.
3
Identify the limitation of RA-GRS write path.
Write operations to the secondary endpoint are blocked and only permitted after promoting the secondary region via failover.
To conclude why the proposed active-active write design is invalid.

Anahtar Kavram

Read-Access Geo-Redundant Storage (RA-GRS) replication and write path limitations
Tahmini Süre:45s
Soru 355Soru

An online gaming platform is deploying its backend database on Azure Virtual Machines. The database transaction logs require storage that supports sub-millisecond write latency. Additionally, game assets in Azure Storage must be securely shared with external developers using temporary access tokens that can be quickly revoked if a leak occurs. The entire storage solution must remain available even during a local zone outage in the primary Azure region.

Which two configurations should you include in the storage design? (Select two).

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Premium SSD v2 managed disks with Zone-Redundant Storage (ZRS) for the database transaction logs.; Generate Shared Access Signature (SAS) tokens associated with a stored access policy for sharing game assets.

Cevap

Use Premium SSD v2 managed disks with Zone-Redundant Storage (ZRS) for the database transaction logs, and generate Shared Access Signature (SAS) tokens associated with a stored access policy for sharing game assets.
Premium SSD v2 managed disks offer high performance and sub-millisecond latency, making them ideal for transaction logs, while ZRS provides protection against zone outages. Using stored access policies for Shared Access Signatures (SAS) ensures that access to assets can be instantly revoked by modifying or deleting the policy, meeting the security and administrative requirements.

Adım Adım Çözüm

1
Analyze the database performance and availability requirements.
The transaction logs require sub-millisecond latency and zone redundancy.
Database performance demands high IOPS/throughput and low latency, while the system must survive a zone outage.
2
Evaluate the disk storage types and redundancy configurations.
Premium SSD v2 disks with ZRS meet both the performance and zone-redundancy requirements.
Standard HDD/SSD cannot meet sub-millisecond latency, and LRS does not survive a zone outage.
3
Analyze the asset sharing security and revocation requirements.
The access tokens must be temporary and easily revocable.
Using stored access policies with SAS tokens allows instant revocation by deleting or modifying the policy, whereas ad-hoc SAS tokens cannot be easily revoked without rotating the primary/secondary keys.

Anahtar Kavram

Selecting optimal disk types for performance, choosing the appropriate redundancy level for high availability, and securing blob storage access using stored access policies.
Soru 356Soru

A legal services firm is designing a secure Azure Blob storage solution for hosting sensitive litigation files. External forensic investigators require temporary read-only access to specific folders inside a container for a period of up to 48 hours. The access must be restricted to a specific external public IP range. The firm's security policy requires that administrative control must be maintained to immediately revoke access if a breach is suspected, without rotating the storage account access keys or impacting other active access tokens. Which two configuration steps should you include in the design to meet these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a stored access policy on the target container and generate a Shared Access Signature (SAS) token associated with that policy.; Configure the allowed public IP address range directly on the parameters of the generated Shared Access Signature (SAS) token.

Cevap

Create a stored access policy on the target container, generate a Shared Access Signature (SAS) token associated with that policy, and configure the allowed public IP address range directly on the parameters of the generated SAS token.
To implement immediately revocable, time-bound access for external users without rotating storage account keys, you must create a stored access policy and generate a SAS token associated with that policy. Deleting or modifying the policy immediately invalidates the SAS token. To restrict the network origin, you must configure the allowed public IP address range directly in the SAS token parameters.

Adım Adım Çözüm

1
Select the appropriate authorization method to allow external, temporary, and immediately revocable access.
Identify that Shared Access Signatures (SAS) are ideal for external users, but must be tied to a Stored Access Policy to enable immediate revocation without rotating keys.
Ad-hoc SAS tokens cannot be revoked individually; deleting or modifying a Stored Access Policy immediately invalidates all SAS tokens generated from it.
2
Address the network restriction requirement.
Configure the allowed IP address range parameter on the SAS token.
This restricts access to the specified public IP range of the external investigators at the authentication layer.

Anahtar Kavram

Stored Access Policies vs. Ad-hoc SAS and parameter-based network constraints for access control.
Tahmini Süre:2m 0s
Soru 357Soru

A company is planning to migrate a legacy on-premises SQL Server application to Azure. The application has the following database requirements:

* Must run scheduled maintenance jobs using SQL Server Agent.
* Requires database-level integration with the Common Language Runtime (CLR).
* Must restrict all database network traffic to a private virtual network.
* Must minimize database administration effort, including operating system updates and database engine patching.

Which two components should you include in the relational database solution design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance; A delegated subnet in an Azure Virtual Network

Cevap

Azure SQL Managed Instance and a delegated subnet in an Azure Virtual Network
Azure SQL Managed Instance is the recommended deployment option because it supports SQL Server Agent and CLR integration while operating as a fully managed PaaS service that automates database patching and operating system updates. To deploy Azure SQL Managed Instance, you must place it within a delegated subnet in an Azure Virtual Network, which satisfies the requirement for private network isolation.

Adım Adım Çözüm

1
Analyze compatibility requirements
SQL Server Agent and CLR integration are legacy features supported by Azure SQL Managed Instance and SQL Server on Azure Virtual Machines, but not by Azure SQL Database (single database or elastic pools).
This narrows down the database deployment options based on feature requirements.
2
Evaluate administrative overhead requirements
Azure SQL Managed Instance is a PaaS option that automates OS updates and database engine patching. SQL Server on Azure Virtual Machines is IaaS and requires manual patching.
This filters out the virtual machine option to satisfy the administrative minimization requirement.
3
Determine network integration requirements
Azure SQL Managed Instance is deployed natively into a delegated subnet within an Azure Virtual Network to secure traffic privately.
This identifies the required networking component for the chosen database tier.

Anahtar Kavram

Selecting and configuring the correct Azure SQL deployment tier based on legacy feature support, network requirements, and administrative overhead.

Alternatif Yöntem

Instead of migrating to Azure SQL Managed Instance, a hybrid migration using Azure Data Factory could be used to orchestrate data movement, but Managed Instance remains the primary database target satisfying the legacy requirements directly.
Tahmini Süre:2m 0s
Soru 358Soru

An enterprise stores application logs in Azure Blob Storage. The logs are frequently accessed during the first 30 days. Between 30 and 180 days, they are accessed occasionally but still require immediate, sub-second retrieval. After 180 days, the logs are rarely accessed and can tolerate retrieval latencies of up to several hours. You need to configure a lifecycle management policy to minimize storage costs. Which two actions should you include in the policy rule?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition blobs to cool storage 30 days after creation; Transition blobs to archive storage 180 days after creation

Cevap

Transition blobs to cool storage 30 days after creation AND Transition blobs to archive storage 180 days after creation
The correct options transition the blobs to cool storage after 30 days and to archive storage after 180 days. This matches the access patterns and retrieval latency limits: the cool tier allows immediate sub-second access for the occasional queries between days 30 and 180, and the archive tier minimizes cost after 180 days when latency is no longer a concern.

Adım Adım Çözüm

1
Analyze access frequency and latency requirements for the first phase (0-30 days).
Data is frequently accessed, requiring Hot tier (default) storage.
Hot tier provides the lowest retrieval latency for frequent access.
2
Analyze access frequency and latency requirements for the second phase (30-180 days).
Identify that Cool tier matches occasional access with sub-second retrieval times.
Transitioning to Cool storage after 30 days saves costs while satisfying the immediate retrieval constraint.
3
Analyze access frequency and latency requirements for the final phase (after 180 days).
Identify that Archive tier is appropriate as retrieval latency is no longer a constraint.
Transitioning to Archive storage after 180 days maximizes cost savings for rarely accessed data.

Anahtar Kavram

Azure Blob Storage lifecycle management policy rules support transitioning blobs to cooler storage tiers (Cool, Cold, Archive) based on the age of the blob to optimize costs while respecting retrieval latency constraints.
Soru 359Soru

A company is planning to migrate an on-premises database to Azure. The database relies on SQL Server Agent jobs and cross-database queries. The migrated database must meet the following requirements:
- Provide high availability and automatic failover to a paired secondary region.
- Do not require modifications to the application connection strings during a failover.
- Support offloading read-only reporting queries to the secondary region.

Which two options should you include in the design to meet the requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance as the database deployment option; An auto-failover group configured for the database instances

Cevap

The design must include Azure SQL Managed Instance and an auto-failover group.
To meet the requirements, the design must use Azure SQL Managed Instance because it supports SQL Server Agent and cross-database queries, which are legacy features from the on-premises environment. Additionally, configuring an auto-failover group ensures automatic failover and provides read-write and read-only listener endpoints that prevent the need to modify application connection strings during a failover.

Adım Adım Çözüm

1
Analyze legacy feature requirements of the on-premises database.
Identify SQL Server Agent and cross-database queries as key features.
These features are only natively supported in Azure SQL Managed Instance or SQL Server on Azure VMs, ruling out Azure SQL Database single database.
2
Evaluate high availability and disaster recovery requirements.
Identify the need for automatic failover, no connection string modifications, and read-only reporting offload.
Auto-failover groups provide automatic failover and unique listeners (read-write and read-only) that automatically route traffic to the appropriate region without client-side updates.

Anahtar Kavram

Selecting the appropriate Azure SQL deployment option based on legacy feature requirements and configuring auto-failover groups for seamless multi-region HA/DR with read-scale routing.
Tahmini Süre:2m 0s
Soru 360Soru

A financial services company is planning to migrate its core transactional database to Azure. The database layer has the following requirements:
- The database application relies on third-party system agents that require direct access to the underlying operating system.
- The solution must achieve high availability (HA) within the primary region with a 99.99%99.99\% availability service level agreement (SLA), zero data loss (RPO=0RPO = 0), and automatic failover.
- For disaster recovery (DR), the data must be replicated to a secondary region, supporting manual failover with a Recovery Point Objective (RPORPO) of under 1010 seconds.
- The database transaction logs have extremely high write activity and require sub-millisecond write latency.

Which of the following database architectures should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy SQL Server on Azure Virtual Machines. Configure an Always On availability group with synchronous-commit replicas across Availability Zones in the primary region and an asynchronous-commit replica in the secondary region. Store the transaction logs on Premium SSD v2 or Ultra Disk volumes.

Cevap

Deploy SQL Server on Azure Virtual Machines. Configure an Always On availability group with synchronous-commit replicas across Availability Zones in the primary region and an asynchronous-commit replica in the secondary region. Store the transaction logs on Premium SSD v2 or Ultra Disk volumes.
Deploying SQL Server on Azure Virtual Machines satisfies the requirement for direct operating system access needed by third-party agents. Configuring a SQL Server Always On availability group with synchronous-commit replicas across Availability Zones in the primary region provides automatic failover and zero data loss (RPO=0RPO = 0), meeting the 99.99%99.99\% SLA. Adding an asynchronous-commit replica in the secondary region satisfies the disaster recovery requirement with an RPO of under 1010 seconds without impacting primary transaction throughput. Utilizing Premium SSD v2 or Ultra Disk volumes for the transaction logs ensures sub-millisecond write latency.

Adım Adım Çözüm

1
Analyze hosting requirements.
SQL Server on Azure Virtual Machines (IaaS) must be selected because the application relies on third-party system agents that require direct access to the underlying operating system. Fully managed options like Azure SQL Database or Azure SQL Managed Instance (PaaS) must be ruled out.
Direct OS access is not available in PaaS relational database offerings in Azure.
2
Evaluate intra-region High Availability (HA) requirements.
Configure a SQL Server Always On availability group with synchronous-commit replicas deployed across Availability Zones in the primary region.
This guarantees zero data loss (RPO=0RPO = 0), provides automatic failover, and achieves a high SLA (99.99%99.99\%) by utilizing multiple availability zones.
3
Evaluate inter-region Disaster Recovery (DR) requirements.
Add an asynchronous-commit replica in the secondary Azure region to the availability group.
Asynchronous-commit replication is designed for cross-region disaster recovery, minimizing the performance impact on the primary database while keeping the replication lag (RPO) minimal, typically well under 1010 seconds.
4
Determine the appropriate storage tier for the database transaction logs.
Select Premium SSD v2 or Ultra Disk volumes for the transaction log files.
The transaction logs require sub-millisecond write latency under high-write workloads. Standard HDD or Standard SSD volumes cannot meet these performance demands.

Anahtar Kavram

Designing High Availability and Disaster Recovery for SQL Server on Azure VMs using Always On Availability Groups and high-performance storage.
ÖncekiSayfa 18 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Solutions Architect (AZ-305) | Examkin