Tüm alıştırma soruları

65 soru

Soru 21Soru

A retail company is designing a monitoring and log routing architecture for its Azure workloads. You need to match each monitoring requirement to its correct Azure Monitor destination or feature. Which destination or feature should you associate with each requirement?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Archive subscription-level Azure Activity logs for 5 years to meet regulatory compliance audits at the lowest storage cost.
Stream diagnostic logs from an Azure Application Gateway in near real-time to a third-party SIEM system.
Perform complex query analysis and correlation across multiple resources using Kusto Query Language (KQL).
Configure alerts on virtual machine CPU utilization that trigger within a minute of a threshold breach.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Archive subscription-level Azure Activity logs for 5 years to meet regulatory compliance audits at the lowest storage cost matches with Azure Storage account; Stream diagnostic logs from an Azure Application Gateway in near real-time to a third-party SIEM system matches with Azure Event Hubs; Perform complex query analysis and correlation across multiple resources using Kusto Query Language (KQL) matches with Azure Monitor Log Analytics workspace; Configure alerts on virtual machine CPU utilization that trigger within a minute of a threshold breach matches with Azure Monitor Metrics.
The matching pairs correctly align each specific monitoring and alerting requirement to the Azure service designed to address it. Under Azure Monitor diagnostic settings, logs can be routed to a Storage Account for low-cost compliance archiving, Event Hubs for real-time external pipeline integration, or a Log Analytics workspace for KQL query analytics. Time-series metrics are natively written to the Azure Monitor Metrics database to enable sub-minute metric alerts.

Adım Adım Çözüm

1
Analyze the log archiving requirement.
Long-term (5-year) compliance retention with the primary constraint of 'lowest storage cost' maps to Azure Storage, as archiving logs to blob storage is significantly cheaper than retaining them in a Log Analytics workspace.
To satisfy retention requirements cost-effectively.
2
Analyze the real-time external streaming requirement.
Streaming diagnostic logs to a third-party, non-Azure SIEM in near real-time is best achieved by routing logs through Azure Event Hubs, which acts as a message broker for ingestion pipelines.
To support external SIEM ingestion.
3
Analyze the query and correlation requirement.
Querying logs via Kusto Query Language (KQL) requires the logs to be stored in an Azure Monitor Log Analytics workspace, which is the native environment for log search and correlation queries.
To enable interactive log querying with KQL.
4
Analyze the near real-time alerting requirement.
Metric alerts targeting fast evaluation times (e.g., under a minute) run against the Azure Monitor Metrics store (a time-series database) rather than Log Analytics logs, providing quicker alert response times.
To minimize latency for infrastructure alerts.

Anahtar Kavram

Log routing destinations in Azure Monitor support distinct operational requirements, where Storage Accounts are optimized for cost-effective long-term retention, Event Hubs for real-time external integration, Log Analytics workspaces for rich KQL queries, and Azure Monitor Metrics for low-latency alerting.
Soru 22Soru

You are designing an identity and access management solution for a company. Match each security requirement to the most appropriate Microsoft Entra ID or Conditional Access feature.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require administrative users to request temporary elevation to active roles and verify their identity via MFA prior to managing Azure resources.
Bypass MFA requirements for users who are accessing cloud resources from the corporate office's public IP range.
Block access to cloud applications for users connecting from specific geographical locations outside of the corporate footprint.
Enforce multifactor authentication (MFA) only when a user's sign-in attempt shows a medium or high risk level.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The security requirements are mapped as follows: Role activation settings in Entra ID Privileged Identity Management (PIM) are used to enforce MFA and approval for temporary admin elevation. Trusted IP Named Locations in Conditional Access are used to bypass MFA for corporate networks. Geography-based Named Locations with block controls in Conditional Access are used to block access from unauthorized countries. Entra ID Protection Sign-in risk policies are used to enforce MFA dynamically based on sign-in risk levels.
The correct pairings align specific identity and security controls with Entra ID features. Enabling PIM role activation settings manages temporary admin privilege elevation. Marking corporate IP ranges as trusted Named Locations enables location-based MFA bypass in Conditional Access. Creating geographic Named Locations with block controls restricts unauthorized international sign-ins. Applying Entra ID Protection policies secures sign-ins based on calculated risk thresholds.

Adım Adım Çözüm

1
Analyze administrative elevation and MFA requirements.
Identify that temporary elevation and MFA before administrative actions map to Entra ID Privileged Identity Management (PIM).
PIM is designed to manage, control, and monitor access to important resources, including requiring approval and MFA for active role assignment.
2
Analyze trusted network bypass requirements.
Identify that bypassing MFA using corporate office IP ranges maps to Conditional Access with IP-based trusted Named Locations.
Conditional Access policies can exclude trusted locations (defined by IP ranges) from MFA requirements.
3
Analyze geographical restriction requirements.
Identify that blocking access from unauthorized countries maps to Conditional Access with geography-based Named Locations.
Geography-based Named Locations define country borders, which can be referenced in Conditional Access policies to deny or block access.
4
Analyze risk-based authentication requirements.
Identify that medium or high sign-in risk triggers map to Entra ID Protection policies.
Entra ID Protection evaluates sign-in telemetry and enforces controls like MFA or password changes based on user or sign-in risk levels.

Anahtar Kavram

Microsoft Entra ID Authentication and Conditional Access
Tahmini Süre:1m 30s
Soru 23Soru

Zephyr Logistics is designing a hybrid identity and multi-tenant collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest with 82008{}200 users. You are tasked with selecting the appropriate identity integration and collaboration technologies to satisfy the company's security, compliance, and availability requirements.

Match each business requirement on the left to the correct Microsoft Entra ID or hybrid identity technology on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Authenticate users in the cloud even during an on-premises network outage, minimizing on-premises infrastructure.
Authenticate users against on-premises Active Directory in real-time without storing credential hashes in the cloud.
Authenticate users using existing on-premises smart cards, keeping all authentication policies within the corporate network perimeter.
Allow external partner users to securely access corporate applications using their own organizational identity providers.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Authenticate users in the cloud during outages matches Password Hash Synchronization (PHS). Authenticate users in real-time without cloud hashes matches Pass-through Authentication (PTA). Authenticate users using smart cards within the perimeter matches Active Directory Federation Services (AD FS). Allow partner users to access resources using their own identity provider matches Microsoft Entra B2B Collaboration.
The correct matches align each scenario with its primary architectural capability. Password Hash Synchronization (PHS) offers high availability by allowing Entra ID to authenticate users independently of on-premises connectivity. Pass-through Authentication (PTA) provides real-time local validation without storing hashes in the cloud. Active Directory Federation Services (AD FS) handles specialized on-premises authentication requirements like smart card/certificate validation and local perimeter policy enforcement. Microsoft Entra B2B Collaboration facilitates secure, external partner access by trusting their home identity provider.

Adım Adım Çözüm

1
Analyze the requirement for outage resilience and minimal on-premises footprint.
Password Hash Synchronization (PHS) is selected as it offloads authentication to Entra ID and has zero runtime dependency on the on-premises environment once synced.
This guarantees sign-in availability during network or on-premises server outages.
2
Analyze the requirement for real-time authentication without storing credential hashes in the cloud.
Pass-through Authentication (PTA) is selected because authentication requests are forwarded to local agents on-premises, and no credential hashes are stored in Microsoft Entra ID.
This satisfies strict organizational compliance rules that forbid cloud credential storage.
3
Analyze the requirement for on-premises smart card authentication and local policy management.
Active Directory Federation Services (AD FS) is selected because federation hands over the authentication handshake to the on-premises directory, permitting the use of smart cards and certificate-based auth.
This keeps authentication traffic and security policy enforcement within the corporate perimeter.
4
Analyze the requirement for partner collaboration using their own identity providers.
Microsoft Entra B2B Collaboration is selected as it allows guest users to use their existing external credentials to sign in, reducing administrative overhead.
This meets the multi-tenant collaboration requirements securely and efficiently.

Anahtar Kavram

Designing hybrid identity authentication methods (PHS, PTA, AD FS) and multi-tenant collaboration strategies (Entra B2B) based on availability, security, and administrative requirements.
Soru 24Soru

An organization is designing a secure access and identity infrastructure using Microsoft Entra ID. The solution must enforce different access controls and verification methods depending on the context of the authentication attempt. Match each business or technical security requirement to the most appropriate Microsoft Entra ID or Conditional Access feature.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require multi-factor authentication (MFA) only when a sign-in attempt is classified as a medium or high risk based on real-time telemetry.
Block access to cloud applications when user connections originate from geographic regions outside the organization's approved operating zones.
Restrict administrative access to Microsoft Azure portal to require phishing-resistant authentication methods such as FIDO2 security keys.
Prevent non-compliant corporate devices from accessing business-critical cloud applications.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Sign-in risk policy matches with requiring MFA for medium/high risk; Named locations match with blocking access from unapproved geographic regions; Authentication strengths match with restricting administrative access to phishing-resistant methods; Device compliance requirement matches with blocking non-compliant devices.
The correct mapping pairs each operational requirement to its specialized Conditional Access or Entra ID authentication capability: risk-based policies monitor real-time threat levels, named locations restrict geographic access, authentication strengths dictate the credential type (such as phishing-resistant), and device state checks verify management compliance.

Adım Adım Çözüm

1
Identify the requirement to evaluate real-time sign-in safety and apply MFA selectively.
This requires evaluating risk levels on a per-session basis, which aligns with Microsoft Entra ID Protection's sign-in risk policies.
Sign-in risk checks verify if the credentials might be compromised during the authentication flow.
2
Identify the requirement to block access based on geographic location parameters.
This maps to defining named locations (either IP ranges or countries) and targeting them within a Conditional Access policy set to block access.
Named locations are the primary mechanism for location-based Conditional Access rules.
3
Identify the requirement to enforce phishing-resistant authentication methods for administrators.
This requires using Entra ID authentication strengths within a Conditional Access policy.
Authentication strengths allow granular specification of permitted credentials (such as FIDO2 security keys) rather than a general MFA challenge.
4
Identify the requirement to verify device health status before permitting app access.
This requires using the device compliance status grant control within a Conditional Access policy.
Conditional Access can read the device compliance status from mobile device management solutions like Microsoft Intune to grant or deny access.

Anahtar Kavram

Designing granular access control policies using Microsoft Entra ID Conditional Access and authentication configurations.
Soru 25Soru

Zenith Retail Global is designing a secure identity and access strategy using Microsoft Entra ID. The solution must map specific access control and threat mitigation requirements to the correct Microsoft Entra ID features. Match each security requirement on the left to its corresponding Microsoft Entra ID or Conditional Access feature on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Enforce that administrators re-authenticate every 4 hours when accessing administrative portals from untrusted locations.
Restrict web-based Outlook sessions on unmanaged devices to read-only access without file download capabilities.
Require phishing-resistant multi-factor authentication (MFA) specifically when accessing a critical financial ledger application.
Force a password change using self-service password reset if user credentials are found to be leaked on the dark web.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Sign-in frequency matches administrators re-authenticating every 4 hours; App-enforced restrictions matches restricting Outlook sessions to prevent downloads on unmanaged devices; Authentication strength matches requiring phishing-resistant MFA for the financial ledger application; User risk policy matches forcing a password change when credentials are leaked on the dark web.
The correct matches align each security requirement with its specific Entra ID capability: Sign-in frequency manages the session duration (4 hours); App-enforced restrictions leverage application capabilities to restrict downloads on unmanaged devices; Authentication strength specifies the exact allowed MFA methods (phishing-resistant); and User risk policy addresses compromised credentials (leaked on the dark web) by requiring a password reset.

Adım Adım Çözüm

1
Analyze the administrative re-authentication requirement.
Identified the need to control the validity duration of user sessions.
Sign-in frequency is a Conditional Access session control that specifies how long a user's sign-in remains valid before they must authenticate again.
2
Analyze the unmanaged device document download restriction requirement.
Identified the need to limit app capabilities based on device compliance/management status.
App-enforced restrictions allow Entra ID to pass device state to Exchange Online or SharePoint Online, allowing those apps to block file downloads during browser-based sessions.
3
Analyze the specific MFA type (phishing-resistant) requirement for the financial application.
Identified the need to define allowed authentication methods beyond basic MFA.
Authentication strength is a grant control that enforces specific methods like phishing-resistant MFA (FIDO2 or Windows Hello for Business) rather than standard MFA.
4
Analyze the leaked credentials scenario.
Identified the threat category as user-specific identity compromise (user risk).
Microsoft Entra ID Protection's User risk policy detects identity-level issues (like leaked credentials on the dark web) and can require self-service password reset (SSPR) to remediate the risk.

Anahtar Kavram

Microsoft Entra ID Conditional Access controls and Microsoft Entra ID Protection policies.
Soru 26Soru

An organization is architecting a globally distributed storage solution using Azure Cosmos DB. The system must support four distinct application components, each with unique data access patterns, migration origins, and scaling requirements. The components must be highly resilient across multiple Azure regions, support sub-10ms read/write latencies, and minimize code changes during migration from legacy environments.

Match each application requirement on the left to the correct Azure Cosmos DB API on the right to align with the workloads.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A migration of an on-premises time-series telemetry store that utilizes Column Family data structures, requiring native Cassandra Query Language (CQL) queries.
A new social media analysis tool mapping complex user relationships, shared interests, and multi-layered hierarchies using graph traversal algorithms.
A global catalog application requiring transactional execution, JSON document indexing, and ad-hoc SQL-like SELECT queries.
An e-commerce shopping cart service migrated from an open-source document store, requiring BSON document compatibility and driver reuse.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match Cassandra Query Language queries to the API for Cassandra; match graph relationships to the API for Gremlin; match SQL-like JSON document queries to the API for NoSQL; and match BSON document workloads to the API for MongoDB.
Each application component is matched to its corresponding Cosmos DB API based on its storage model (wide-column, graph, document) and the compatibility needs of legacy queries.

Adım Adım Çözüm

1
Analyze each workload's storage model and migration constraints.
Identified wide-column, graph traversal, native SQL document, and BSON requirements.
Matching requires parsing the underlying storage patterns and interface compatibility.
2
Map the API compatibility options provided by Azure Cosmos DB.
CQL maps to Cassandra API, Gremlin maps to Gremlin API, SQL document queries map to NoSQL API, and BSON maps to MongoDB API.
Cosmos DB offers specific APIs to match industry-standard protocols to ease migration paths.

Anahtar Kavram

Azure Cosmos DB Multi-Model APIs
Soru 27Soru

Aetheris Biotech is designing an identity and access management strategy for its Microsoft Entra ID tenant to comply with new pharmaceutical data protection standards. The cloud architecture team has identified four distinct security requirements for different groups of users and applications. Match each security and compliance requirement on the left to the most appropriate Microsoft Entra ID Conditional Access configuration or feature on the right that achieves the requirement with the least administrative effort.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require external consultants to perform MFA and accept a data-sharing agreement every 30 days when accessing internal research portals.
Enforce MFA for all off-site employee connections, while excluding requests that originate from the corporate headquarters' public IP addresses.
Prevent access to the sensitive drug-formulation database if Entra ID detects abnormal sign-in patterns, such as travel to an unexpected location.
Ensure administrators can only manage Azure resources if they are using a corporate-managed device that is registered and marked as healthy.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches align each security requirement to its respective Microsoft Entra ID Conditional Access control. Specifically: external consultants re-verifying every 30 days maps to sign-in frequency and terms of use; enforcing MFA except for physical office IPs maps to location conditions with named location exclusions; preventing access on abnormal sign-in patterns maps to high sign-in risk condition; and requiring managed healthy devices maps to device compliance grant control.
Each business requirement correlates directly with a built-in Conditional Access capability: periodic re-validation uses Sign-in frequency and Terms of Use; office network bypass uses Named Location exclusions; abnormal behavior blocks use high sign-in risk evaluation; and managed/healthy devices utilize the device compliance grant control.

Adım Adım Çözüm

1
Map the requirement for external consultants re-authenticating and signing an agreement every 30 days.
This requires session duration limits (Sign-in frequency) and legal/policy acceptance (Terms of Use).
Sign-in frequency controls how often a user must sign in again, and Terms of Use ensures compliance agreements are accepted.
2
Map the requirement for enforcing MFA off-site but bypassing it on-site.
This requires location conditions using Named Locations as an exclusion.
Named Locations define trusted IP ranges, and excluding these ranges from the MFA policy allows seamless on-premises access.
3
Map the requirement for blocking access due to abnormal travel and sign-in behavior.
This requires configuring a Sign-in risk level policy targeting High risk.
Microsoft Entra ID Protection calculates real-time sign-in risk (such as atypical travel), which can be evaluated in Conditional Access policies to block access.
4
Map the requirement for administrative device health and management.
This requires device compliance or hybrid joined grant controls.
Requiring a device to be marked as compliant ensures the device meets organization health policies before allowing access.

Anahtar Kavram

Microsoft Entra ID Authentication and Conditional Access
Tahmini Süre:2m 0s
Soru 28Soru

You are designing the storage architecture for an enterprise modernization project. You need to match the application workloads and migration requirements to the most appropriate Azure Cosmos DB API. To answer, match each workload scenario on the left with its corresponding Azure Cosmos DB API on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A modernized e-commerce shopping cart service requiring JSON document storage, SQL-like querying over hierarchical data, and enterprise-grade multi-region writes.
A real-time fraud detection engine that models and queries highly connected multi-hop relationships and dependency networks among entities.
A migration of a legacy wide-column telemetry database that executes Cassandra Query Language (CQL) queries, requiring minimal codebase changes.
A customer profile database migration from an on-premises database that uses native BSON serialization and requires compatibility with existing MongoDB driver libraries.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match the e-commerce shopping cart to API for NoSQL, the fraud detection engine to API for Gremlin, the wide-column telemetry database to API for Cassandra, and the customer profile database to API for MongoDB.
The correct matches align the workload patterns and migration specifications to their respective Azure Cosmos DB API wire protocols: native SQL queries on JSON documents map to API for NoSQL; graph and relationship traversals map to API for Gremlin; wide-column CQL workloads map to API for Cassandra; and BSON-based document workloads map to API for MongoDB.

Adım Adım Çözüm

1
Analyze the shopping cart requirement
Requires JSON document storage and SQL-like querying. This maps directly to the native Azure Cosmos DB API for NoSQL.
API for NoSQL is designed for native SQL-like queries over JSON documents.
2
Analyze the fraud detection requirement
Requires modeling multi-hop relationships and dependency networks. This maps to graph database structures supported by the API for Gremlin.
Gremlin is the graph-traversal standard supported by Cosmos DB.
3
Analyze the legacy wide-column telemetry requirement
Requires CQL query execution and wide-column compatibility. This maps to the API for Cassandra.
API for Cassandra provides CQL wire protocol compatibility.
4
Analyze the customer profile migration requirement
Requires BSON serialization and compatibility with existing MongoDB drivers. This maps to the API for MongoDB.
API for MongoDB implements the MongoDB wire protocol.

Anahtar Kavram

Azure Cosmos DB API selection based on workload characteristics and migration requirements.
Tahmini Süre:2m 0s
Soru 29Soru

An organization is designing an identity security strategy using Microsoft Entra ID. You need to match the specific security and access requirements to the correct Microsoft Entra ID Authentication or Conditional Access feature. How should you match the requirements to the appropriate features?

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Prevent users on unmanaged personal devices from downloading, printing, or syncing files when accessing SharePoint Online.
Enforce the use of phishing-resistant authentication methods, such as FIDO2 security keys, when administrators access the Azure portal.
Force users to re-authenticate if their active session is older than 8 hours when they access a critical financial application.
Block access to all cloud applications if a user's sign-in pattern matches real-time anomalous detection patterns indicative of a compromised session.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Preventing downloads on unmanaged devices matches the app-enforced restrictions session control. Enforcing phishing-resistant methods for administrators matches the authentication strengths grant control. Forcing re-authentication after 8 hours matches the sign-in frequency session control. Blocking access for anomalous sign-ins matches the Entra ID Protection sign-in risk-based policy.
Matching the security requirements to their respective Microsoft Entra features relies on understanding the differentiation between session controls, grant controls, and risk-based policy options. App-enforced restrictions are designed for session-level controls in SharePoint/Exchange. Authentication strengths provide granular MFA requirements. Sign-in frequency manages the session lifetime. Sign-in risk policies evaluate live, dynamic threats.

Adım Adım Çözüm

1
Analyze the requirement for unmanaged personal devices accessing SharePoint Online.
Identified that restricting down-level actions (download, print, sync) requires the cloud application to receive device status from Entra ID and enforce those restrictions, which is configured via Conditional Access session controls using app-enforced restrictions.
This is a typical use case for SharePoint Online and Exchange Online integrations with Conditional Access.
2
Analyze the requirement to restrict administrative access to phishing-resistant MFA methods.
Identified that Conditional Access grant controls natively support authentication strengths to enforce specific MFA combinations (e.g., phishing-resistant MFA including FIDO2 or Windows Hello for Business).
Standard MFA options allow less secure methods like SMS, so authentication strengths are needed to restrict to phishing-resistant methods.
3
Analyze the requirement for forcing re-authentication after 8 hours.
Identified that the sign-in frequency session control in Conditional Access allows specifying a time interval after which a user must sign in again.
This configuration manages session lifetimes for high-value applications.
4
Analyze the requirement to block anomalous sign-in attempts indicating a compromised session.
Identified that real-time anomalous sign-in detection requires Entra ID Protection (formerly Azure AD Identity Protection) sign-in risk-based policy to evaluate the sign-in risk and apply block or MFA controls.
Conditional Access policies can consume sign-in risk signals from Microsoft Entra ID Protection to dynamically block access.

Anahtar Kavram

Microsoft Entra ID offers advanced authentication capabilities and Conditional Access policies, including session controls, authentication strengths, and risk-based integrations, to implement a Zero Trust access security model.
Soru 30Soru

An enterprise is planning their Azure load balancing and high availability architecture. You must select the appropriate routing solutions for their workloads. Match each Azure service to its primary traffic routing mechanism and scope.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Azure Traffic Manager
Azure Front Door
Azure Application Gateway

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Azure Traffic Manager matches DNS-based routing; Azure Front Door matches global Anycast-based HTTP/HTTPS routing; Azure Application Gateway matches regional virtual network-based routing.
The correct matches align each service with its unique operational layer and scope. Azure Traffic Manager relies on DNS to resolve endpoints globally, Azure Front Door leverages Anycast TCP at the edge for global web application delivery, and Azure Application Gateway manages regional, virtual network-integrated Layer 7 traffic routing.

Adım Adım Çözüm

1
Identify the routing mechanism of Azure Traffic Manager.
Azure Traffic Manager operates at the DNS level, returning the IP address of the preferred endpoint directly to the client.
This matches the definition of a DNS-based global traffic router.
2
Identify the routing mechanism of Azure Front Door.
Azure Front Door terminates client HTTP/HTTPS requests at edge sites using Anycast TCP, optimizing global paths.
This matches the definition of an Anycast TCP global HTTP/HTTPS router.
3
Identify the routing mechanism of Azure Application Gateway.
Azure Application Gateway acts as a regional reverse proxy within a specific virtual network, routing by URL paths.
This matches the definition of a regional Layer 7 load balancer.

Anahtar Kavram

Distinction between DNS-based global routing, Anycast-based global routing, and regional Layer 7 load balancing in Azure.
Tahmini Süre:1m 0s
Soru 31Soru

You are a Solutions Architect designing a data migration and modernization strategy for an enterprise. You need to map several application workloads and legacy databases to the most appropriate Azure Cosmos DB API based on their data model, query requirements, and migration constraints. Match each workload scenario on the left with the correct Azure Cosmos DB API on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A legacy tabular database storing time-series sensor logs must be migrated from an Apache Cassandra cluster. The solution must support existing Cassandra Query Language (CQL) queries and driver configurations with minimal code modifications.
A social network application requires a database that can store complex relationships between users, pages, and posts. The solution must support low-latency graph traversals and queries utilizing vertices and edges.
A product catalog storing hierarchical JSON documents must be migrated from an on-premises MongoDB replica set. The solution must maintain compatibility with existing MongoDB query operators and drivers.
A new order processing application requires a transactional store with full support for SQL-like queries, schema-agnostic indexing, and server-side programming via JavaScript stored procedures.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Legacy Cassandra workloads match to Azure Cosmos DB for Apache Cassandra; Graph workloads match to Azure Cosmos DB for Apache Gremlin; Legacy MongoDB workloads match to Azure Cosmos DB for MongoDB; Native SQL-based transactional document workloads match to Azure Cosmos DB for NoSQL.
The correct matches align the workload migration requirements and data models with the corresponding Azure Cosmos DB APIs. Apache Cassandra workloads map to the Cassandra API to preserve CQL compatibility; graph workloads map to the Gremlin API for vertices/edges traversals; MongoDB document models map to the MongoDB API to preserve driver and operator compatibility; and native SQL-based transactional document workloads map to the NoSQL API.

Adım Adım Çözüm

1
Analyze the legacy data store and compatibility requirements for the first scenario, which mentions an Apache Cassandra database, CQL queries, and Cassandra driver configurations.
Identify that Azure Cosmos DB for Apache Cassandra is wire-protocol compliant and preserves CQL compatibility.
This avoids code rewrites for Cassandra driver-based applications.
2
Analyze the query and model requirements for the second scenario, which specifies low-latency graph traversals, relationships, vertices, and edges.
Identify that Azure Cosmos DB for Apache Gremlin is the graph-optimized API supporting Apache TinkerPop and Gremlin queries.
Other APIs do not natively support graph-specific traversal mechanics.
3
Analyze the document structure and driver compatibility requirements for the third scenario, which highlights hierarchical JSON documents and MongoDB query operators.
Identify that Azure Cosmos DB for MongoDB provides the required wire protocol compatibility for MongoDB applications.
This allows existing MongoDB applications to run on Cosmos DB without code modification.
4
Analyze the requirements for the new transactional application in the fourth scenario, focusing on SQL queries, server-side JavaScript execution, and schema-agnostic indexing.
Identify that Azure Cosmos DB for NoSQL is the native document API providing these capabilities.
The NoSQL API natively supports SQL query dialect and server-side JavaScript programming.

Anahtar Kavram

Selecting the appropriate Azure Cosmos DB API based on database compatibility, data structure, and query language capabilities.
Tahmini Süre:2m 0s
Soru 32Soru

Apex Autonomy is designing a secure identity and access management strategy in Microsoft Entra ID. You need to match the specific security and operational access requirements to the corresponding Microsoft Entra Conditional Access settings.

To answer, match each security requirement on the left to the correct Conditional Access setting on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require external contractors to use phishing-resistant multi-factor authentication (MFA) when accessing sensitive source code repositories.
Prevent users from copying, pasting, or downloading files when they access Exchange Online from unmanaged personal devices.
Force administrators to re-authenticate if they attempt to access the Azure portal after their session has been active for more than 4 hours.
Block access to the enterprise resource planning (ERP) system if a user attempts to log in from a location not defined by IP ranges or GPS coordinates.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

To satisfy the security requirements:
- Requiring phishing-resistant MFA is accomplished by selecting the Grant controls: Require authentication strength setting.
- Restricting actions like downloading or copying files on unmanaged devices is achieved via the Session controls: Use Conditional Access App Control setting.
- Forcing administrative re-authentication after a set period is controlled by the Session controls: Sign-in frequency setting.
- Restricting access based on coordinates or IP ranges uses the Conditions: Location setting.
Each security requirement aligns with a specific component of a Microsoft Entra Conditional Access policy. Re-authentication frequency is managed through the Sign-in frequency session control. Control over device actions such as preventing downloads requires Session controls integrated with Microsoft Defender for Cloud Apps. Phishing-resistant MFA is enforced via Authentication strength in Grant controls. Geolocation or IP limits are managed via Location conditions.

Adım Adım Çözüm

1
Analyze the first requirement for enforcing phishing-resistant MFA.
Identify that configuring specific MFA methods (like FIDO2 keys) is handled by Authentication Strength.
Authentication strength is a Grant control configuration that defines which authentication methods are acceptable for a user to access a resource.
2
Analyze the second requirement for preventing file downloads/copying on unmanaged devices.
Identify that restricting in-app actions requires session monitoring and enforcement via Microsoft Defender for Cloud Apps integration.
Conditional Access App Control is a Session control that proxies the web session to restrict real-time user activities like file downloads.
3
Analyze the third requirement for forcing administrator re-authentication after a set time.
Identify the setting that controls session duration lifetime.
Sign-in frequency is a Session control that sets the maximum time a session can remain valid before requiring new credential inputs.
4
Analyze the fourth requirement for restricting access based on geographical boundaries.
Identify the policy evaluation criterion for network origin.
The Location condition evaluates the IP or GPS position of the incoming request to determine whether to apply the policy rules.

Anahtar Kavram

Microsoft Entra ID Conditional Access controls and conditions mapping
Tahmini Süre:2m 0s
Soru 33Soru

Match each Azure traffic routing and load balancing service to its appropriate architecture requirement.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Global routing for HTTP(S) workloads with Anycast, SSL offloading, and web application firewall integration.
Global DNS-based routing for non-HTTP or multi-protocol endpoints requiring path/port independent redirection.
Regional routing for HTTP(S) workloads supporting URL path-based routing and cookie-based affinity.
Regional load balancing for non-HTTP TCP/UDP workloads requiring high-throughput and ultra-low latency.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Global routing for HTTP(S) workloads with Anycast matches Azure Front Door; Global DNS-based routing matches Azure Traffic Manager; Regional routing for HTTP(S) workloads matches Azure Application Gateway; Regional load balancing for non-HTTP TCP/UDP workloads matches Azure Load Balancer.
The correct matches align each load balancing service with its specific scope (global or regional) and network layer (Layer 4 or Layer 7). Azure Front Door and Azure Traffic Manager handle global traffic at Layer 7 and DNS level respectively. Azure Application Gateway and Azure Load Balancer distribute regional traffic at Layer 7 and Layer 4 respectively.

Adım Adım Çözüm

1
Identify the geographical scope for each requirement.
Requirements 1 and 2 are global; Requirements 3 and 4 are regional.
This narrows down choices between global load balancers (Azure Front Door, Azure Traffic Manager) and regional load balancers (Azure Application Gateway, Azure Load Balancer).
2
Identify the protocol layer (Layer 7 HTTP/S vs. Layer 4 TCP/UDP/DNS) for the global services.
Global HTTP(S) workloads needing SSL offloading match Azure Front Door; global DNS-based multi-protocol workloads match Azure Traffic Manager.
Azure Front Door is a Layer 7 Anycast service, whereas Azure Traffic Manager operates purely at the DNS level (Layer 4/DNS).
3
Identify the protocol layer for the regional services.
Regional HTTP(S) path-based routing matches Azure Application Gateway; regional TCP/UDP workloads match Azure Load Balancer.
Azure Application Gateway operates at Layer 7 (supporting URL-based routing), while Azure Load Balancer is a Layer 4 TCP/UDP distribution service.

Anahtar Kavram

Selecting Azure load balancing and traffic routing services based on protocol layer (Layer 4 vs. Layer 7) and geographic scope (global vs. regional).
Soru 34Soru

Zenith Financial Services is designing an identity security strategy using Microsoft Entra ID. The design must meet specific access control requirements for various user roles and device states.

Match each business security requirement to the correct Microsoft Entra ID Conditional Access or authentication control.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require user sign-in sessions to Microsoft 365 applications to prompt for re-authentication every 12 hours.
Limit web-based email access to read-only mode and block attachment downloads on unmanaged personal devices.
Allow access to cloud applications only from devices that are registered in Microsoft Entra ID and meet corporate security baselines.
Enforce the use of FIDO2 security keys or Windows Hello for Business when administrators access the Azure portal.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches are: 1) Prompting for re-authentication every 12 hours matches 'Conditional Access session control: Sign-in frequency'. 2) Blocking attachment downloads on personal devices matches 'Conditional Access session control: App enforced restrictions'. 3) Restricting access to compliant devices matches 'Conditional Access grant control: Require device to be marked as compliant'. 4) Requiring FIDO2 or Windows Hello for Business matches 'Conditional Access grant control: Require authentication strength'.
The correct matches map the specific technical capabilities of Microsoft Entra ID to the corresponding business scenarios. Requiring re-authentication after a set timeframe is handled by the Sign-in frequency session control. Restricting specific app actions like downloading email attachments is managed via App enforced restrictions. Allowing access only to healthy devices is enforced through the 'Require device to be marked as compliant' grant control. Restricting the login methods to phishing-resistant mechanisms such as FIDO2 is handled by the 'Require authentication strength' grant control.

Adım Adım Çözüm

1
Analyze the requirement for prompting user sessions to re-authenticate every 12 hours.
This relates to session lifetime and re-authentication intervals, which is controlled by the Sign-in frequency session control.
Sign-in frequency determines how long a user's session token is valid before they must authenticate again.
2
Analyze the requirement to restrict email attachment downloads on unmanaged personal devices.
This requires collaborating with the underlying application (Exchange Online) to restrict in-app features based on device compliance, which is managed via App enforced restrictions.
App enforced restrictions allow application-level session controls to be applied dynamically based on the device's status.
3
Analyze the requirement to restrict access only to registered and compliant devices.
This represents a binary grant decision (allow or deny) based on device compliance, which maps to the 'Require device to be marked as compliant' grant control.
Device compliance verification requires MDM enrollment (like Microsoft Intune) to evaluate and report on compliance status.
4
Analyze the requirement to mandate FIDO2 or Windows Hello for Business.
This restricts the permitted authentication methods to phishing-resistant options, which is configured via the 'Require authentication strength' grant control.
Authentication strength allows defining specific authentication method requirements, including custom or pre-defined phishing-resistant policies.

Anahtar Kavram

Microsoft Entra ID Authentication and Conditional Access controls (Grant controls vs Session controls)
Tahmini Süre:1m 30s
Soru 35Soru

You are an Azure Solutions Architect designing a data modernization strategy for a global retail enterprise. The architecture must achieve an SLA of 99.999%99.999\% availability for both reads and writes, and support global distribution across three regions: East US, West Europe, and Southeast Asia. The application suite consists of multiple workloads with different read-to-write ratios and data models:

- Workload 1: A recommendation engine that performs relationship-heavy queries (vertices and edges) to map user preferences, requiring a 70:3070:30 read-to-write ratio.
- Workload 2: A globally distributed telemetry processor migrated from an on-premises Apache Cassandra cluster, requiring a 10:9010:90 read-to-write ratio.
- Workload 3: A product catalog migrated from an existing MongoDB cluster that uses complex document aggregation pipelines, requiring an 80:2080:20 read-to-write ratio.
- Workload 4: A simple session-state store migrated from Azure Table Storage requiring high-throughput key-value lookups with a 50:5050:50 read-to-write ratio.

Match each workload description to the most appropriate Azure Cosmos DB API to meet these requirements.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A relationship-heavy recommendation engine that maps complex user connections using vertices and edges.
A high-write telemetry processor migrated from an Apache Cassandra cluster utilizing CQL.
A product catalog migrated from a MongoDB database using document aggregation pipelines.
A session-state key-value store migrated from Azure Table Storage.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Workload 1 matches Azure Cosmos DB for Apache Gremlin; Workload 2 matches Azure Cosmos DB for Apache Cassandra; Workload 3 matches Azure Cosmos DB for MongoDB; Workload 4 matches Azure Cosmos DB for Table.
The correct pairings align each workload with the appropriate Azure Cosmos DB API: the graph-based recommendation engine aligns with the Gremlin API, the Cassandra migration aligns with the Cassandra API, the MongoDB migration aligns with the MongoDB API, and the Table Storage migration aligns with the Table API. This alignment ensures protocol compatibility, query language support, and minimum code changes.

Adım Adım Çözüm

1
Analyze Workload 1 requirements for graph relationships.
The requirement specifies vertices and edges, which indicates a graph database. The matching API is Azure Cosmos DB for Apache Gremlin.
Gremlin is the standard graph API in Cosmos DB.
2
Analyze Workload 2 requirements for Cassandra CQL migration.
The workload is migrated from Apache Cassandra and uses CQL, which maps directly to Azure Cosmos DB for Apache Cassandra.
Cassandra API provides direct wire compatibility for Apache Cassandra workloads.
3
Analyze Workload 3 requirements for MongoDB aggregation pipeline migration.
The catalog data is migrated from MongoDB and uses its document aggregation pipelines, pointing to Azure Cosmos DB for MongoDB.
MongoDB API supports MongoDB query syntax and aggregation commands.
4
Analyze Workload 4 requirements for key-value Table Storage migration.
The session store needs a key-value structure and is migrated from Azure Table Storage, matching Azure Cosmos DB for Table.
Table API provides key-value storage capabilities compatible with SDKs for Azure Table Storage.

Anahtar Kavram

Selecting Azure Cosmos DB APIs based on workload query models and migration compatibility requirements.
Tahmini Süre:2m 0s
Soru 36Soru

An organization is designing a security and access control strategy for its Microsoft Entra ID tenant to protect cloud resources. You need to align the specific security requirements to the corresponding Microsoft Entra ID or Conditional Access features. Match each security requirement to the correct Microsoft Entra ID condition or session control.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Enforce a maximum session lifetime of 1 hour for high-privilege web access to the Azure portal.
Restrict downloading, printing, or syncing files from SharePoint Online when users connect from unmanaged personal devices.
Prompt for multi-factor authentication (MFA) only when Entra ID Protection flags a sign-in attempt as having anomalous telemetry.
Force a password change and require MFA when there is high confidence that a user's credentials have been leaked on the dark web.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Enforce session lifetime matches Sign-in frequency; restrict SharePoint downloads matches App-enforced restrictions; anomalous sign-in prompt matches Sign-in risk; password change for leaked credentials matches User risk.
The correct pairings map each technical requirement to the correct Entra ID capability. Enforcing a maximum session lifetime is configured via Sign-in frequency. Restricting file actions in SharePoint Online is handled by App-enforced restrictions. anomalous sign-in sessions are assessed using Sign-in risk, and leaked credentials represent identity compromise assessed via User risk.

Adım Adım Çözüm

1
Analyze session-related controls for active user connections.
The requirement to force re-authentication after a set time limit (1 hour) is addressed by the Sign-in frequency session control.
Sign-in frequency dictates the time frame before a user must sign in again to access the Azure portal or other apps.
2
Evaluate access limits for specific cloud applications on unmanaged devices.
Restricting downloading, printing, or syncing from SharePoint Online is addressed by App-enforced restrictions.
App-enforced restrictions allow Microsoft Entra ID to pass device compliance status to SharePoint Online, which then restricts file capabilities natively.
3
Differentiate between the two Microsoft Entra ID Protection risk conditions.
Real-time sign-in anomalies correspond to the Sign-in risk condition, while leaked credentials correspond to the User risk condition.
Sign-in risk looks at the specific login session telemetry (e.g., suspicious IPs), whereas User risk evaluates the health of the entire identity (e.g., dark web credential leaks).

Anahtar Kavram

Microsoft Entra ID Authentication and Conditional Access
Tahmini Süre:2m 0s
Soru 37Soru

An organization is modernizing its application portfolio and migrating multiple databases to Azure Cosmos DB. You need to recommend the appropriate Azure Cosmos DB API for each application workload. Match each application workload description to its correct Azure Cosmos DB API.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A social networking application that needs to store and analyze complex relationships, user connections, and interest graphs using graph traversal queries.
An industrial IoT monitoring system that migrates an on-premises wide-column database and requires compatibility with existing Cassandra Query Language (CQL) drivers.
A content management system storing semi-structured article data that must integrate seamlessly with existing MongoDB drivers and aggregation pipelines.
A new cloud-native transactional order processing service that requires optimal performance, low latency, and querying using SQL syntax.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Match the social networking graph application with Azure Cosmos DB for Apache Gremlin, the industrial IoT Cassandra-based telemetry database with Azure Cosmos DB for Apache Cassandra, the MongoDB-compatible content management system with Azure Cosmos DB for MongoDB, and the new cloud-native SQL-queried order processing service with Azure Cosmos DB for NoSQL.
Azure Cosmos DB provides API compatibility with MongoDB, Cassandra, Gremlin, and Table, alongside its native NoSQL API. Matching each workload ensures database migration and feature compatibility: Gremlin for graph workloads, Cassandra for wide-column/CQL workloads, MongoDB for BSON document workloads, and NoSQL for new JSON/SQL-queried workloads.

Adım Adım Çözüm

1
Analyze the social networking graph requirement.
Identified the need to store entities and complex relationships (graph data) and perform traversals, which points to a graph database API.
Azure Cosmos DB for Apache Gremlin is the specific API for graph databases.
2
Analyze the industrial IoT migration requirement.
Identified the need for CQL compatibility and wide-column store support.
Azure Cosmos DB for Apache Cassandra provides compatibility with CQL and Cassandra drivers.
3
Analyze the content management system migration requirement.
Identified the requirement for MongoDB driver and aggregation pipeline compatibility.
Azure Cosmos DB for MongoDB is compatible with the MongoDB wire protocol.
4
Analyze the new cloud-native order processing service requirement.
Identified a new application needing standard SQL querying and optimal performance on Cosmos DB.
Azure Cosmos DB for NoSQL is the native API and uses SQL querying, offering the best integration and performance for new workloads.

Anahtar Kavram

Selecting the appropriate Azure Cosmos DB API based on database compatibility and application requirements.
Soru 38Soru

An enterprise is designing a multi-region disaster recovery and traffic routing architecture for several distinct workloads. Match each traffic routing and failover requirement to the most appropriate Azure service.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Route HTTPS traffic globally, enforce web application firewall (WAF) policies at the edge, offload SSL certificates, and failover within seconds without waiting for DNS client caching to expire.
Route custom TCP/UDP traffic globally to regional endpoints using a single, static Anycast IP address, ensuring low-latency routing without DNS resolution overhead.
Route TCP/UDP traffic globally using geographic or performance-based routing policies, where clients can tolerate failover times governed by DNS TTL values.
Route HTTP/HTTPS traffic regionally within a single Azure virtual network, providing private path-based routing, SSL termination, and cookie-based session affinity.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches are: (1) Route HTTPS traffic globally with edge WAF, SSL offloading, and near-instant failover matches with Azure Front Door. (2) Route custom TCP/UDP traffic globally using a static Anycast IP without DNS overhead matches with Azure Cross-Region Load Balancer. (3) Route TCP/UDP traffic globally using DNS-based geographic/performance policies matches with Azure Traffic Manager. (4) Route HTTP/HTTPS traffic regionally within a single virtual network with SSL termination and session affinity matches with Azure Application Gateway.
Azure Front Door matches global Layer 7 requirements because it offers Anycast-based HTTP/HTTPS routing, SSL offloading, and edge WAF integration with near-instantaneous backend failover. Azure Cross-Region Load Balancer matches global Layer 4 requirements using a single static Anycast IP address to route TCP/UDP packets. Azure Traffic Manager provides DNS-based routing for any protocol globally, which depends on TTL for failover. Azure Application Gateway provides regional, private-network Layer 7 routing, cookie-based session affinity, and SSL termination.

Adım Adım Çözüm

1
Analyze the operational scope (global vs. regional) and layers (Layer 4 vs. Layer 7) of the requirements.
Requirements 1 and 4 need Layer 7 features (WAF, SSL offloading, path routing). Requirements 2 and 3 need Layer 4 or general protocol routing. Requirement 4 is regional, whereas the others are global.
This categorizes the services: Azure Front Door and Application Gateway are Layer 7; Traffic Manager and Cross-Region Load Balancer operate at Layer 4 or DNS level. Application Gateway is regional.
2
Distinguish between the global Layer 7 solution and the regional Layer 7 solution.
The regional HTTP/HTTPS path routing and session affinity requirement maps to Azure Application Gateway. The global HTTPS requirement with WAF at the edge maps to Azure Front Door.
Azure Application Gateway cannot route traffic globally across regions natively, while Azure Front Door is designed for global edge delivery.
3
Differentiate between the global Layer 4 traffic routing mechanisms (Anycast IP routing vs. DNS-based routing).
The custom TCP/UDP workload requiring a single static Anycast IP maps to Azure Cross-Region Load Balancer. The TCP/UDP workload where DNS TTL-based failover is acceptable maps to Azure Traffic Manager.
Azure Cross-Region Load Balancer uses Anycast to route packets over the Microsoft backbone without DNS changes, while Azure Traffic Manager is purely DNS-based.

Anahtar Kavram

Selecting the optimal Azure load balancing and traffic routing service based on application scope (global vs. regional), protocol layer (Layer 4 vs. Layer 7), WAF/SSL requirements, and failover latency tolerance (DNS cache vs. Anycast routing).
Tahmini Süre:2m 30s
Soru 39Soru

An organization is designing the identity security and authentication strategy for its Microsoft Entra ID tenant. You need to match the business and security requirements to the correct Microsoft Entra ID or Conditional Access feature. Match each requirement on the left to its corresponding feature on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require users accessing sensitive applications from untrusted network locations to complete a multi-factor authentication (MFA) prompt.
Block access or require MFA for sign-in attempts that exhibit atypical travel patterns or malware-linked IP addresses.
Enforce read-only web-only access and prevent file downloads when users access SharePoint Online from unmanaged personal devices.
Allow users to authenticate in the cloud using their on-premises passwords, with authentication requests validated directly against local Active Directory domain controllers without storing hashes in the cloud.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The business requirements are matched as follows: location-based MFA requirements match with Location conditions and Grant controls; risk-based sign-in blocking/MFA requirements match with Sign-in risk conditions; read-only access for unmanaged devices on SharePoint Online matches with App Enforced Restrictions session controls; and password validation against on-premises Active Directory without cloud hashes matches with Pass-through Authentication.
The correct matches align the scenarios with their proper Azure security and authentication mechanisms. Requiring MFA for untrusted locations matches Location conditions and Grant controls. Sign-in risks like atypical travel match Sign-in risk conditions. Restricting downloads on unmanaged devices matches App Enforced Restrictions. Validating passwords on-premises without cloud hashes matches Pass-through Authentication.

Adım Adım Çözüm

1
Analyze the requirement for location-based MFA to determine which Conditional Access condition and control applies.
Identify that Location conditions define the network source, and Grant controls enforce the MFA requirement.
This matches the requirement of requiring MFA when users access applications from untrusted networks.
2
Analyze the requirement to detect atypical travel or malware-linked IP addresses during sign-in.
Identify that these behaviors are flagged as sign-in risks, which are handled using Sign-in risk conditions under Conditional Access.
This matches the requirement to enforce security controls based on real-time sign-in risk.
3
Analyze the requirement to restrict SharePoint Online downloads from unmanaged personal devices.
Identify that App Enforced Restrictions session controls allow SharePoint Online to limit session capabilities based on device compliance/management state.
This matches the requirement to prevent downloads and enforce a limited web-only session.
4
Analyze the authentication requirement that validates passwords on-premises without cloud hash storage.
Identify that Pass-through Authentication (PTA) routes password validation directly to on-premises domain controllers using agents, keeping password verification local.
This satisfies the hybrid identity authentication requirement without storing password hashes in Microsoft Entra ID.

Anahtar Kavram

Microsoft Entra ID Authentication methods and Conditional Access policies (including locations, risks, session controls, and hybrid authentication modes like Pass-through Authentication).
Tahmini Süre:1m 30s
Soru 40Soru

An international enterprise is planning a migration and modernization of its data tier to Azure. The migration plan requires 99.999%99.999\% availability for both reads and writes, sub-10 ms10\text{ ms} latency at the 99th percentile, and active-active global distribution across 44 Azure regions. The data storage tier must support an 85:1585:15 read-to-write ratio for the product catalog and a 20:8020:80 ratio for the device telemetry stream. As part of the modernization process, several disparate data systems must be migrated to Azure Cosmos DB.

Match each workload scenario to the most appropriate Azure Cosmos DB API.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A telemetry ingestion pipeline migrating from an on-premises Apache Cassandra cluster that uses CQL-based queries.
A new customer profile store requiring query flexibility with SQL-like query syntax over structured JSON documents.
An interactive social graph platform that tracks complex network relationships, user interactions, and connections.
A legacy retail catalog system currently running on MongoDB and utilizing existing MongoDB drivers and tools.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches pair the telemetry pipeline with the API for Cassandra, the customer profile store with the API for NoSQL, the social graph platform with the API for Gremlin, and the legacy retail catalog with the API for MongoDB.
The correct pairings align the specific workload structure, data model, and migration drivers with their designated Azure Cosmos DB API. Legacy Cassandra systems with CQL map to the API for Cassandra; new JSON document requirements map to the native API for NoSQL; graph relational structures map to the API for Gremlin; and MongoDB legacy workloads map to the API for MongoDB.

Adım Adım Çözüm

1
Analyze the database type and migration compatibility for the legacy Cassandra workload.
The workload uses CQL (Cassandra Query Language), mapping it directly to the API for Cassandra to preserve developer tools and application logic.
Using the matching API reduces rewrite effort and risk.
2
Evaluate the requirement for the customer profile store.
The profile store requires JSON documents and SQL-like querying, which aligns with the native API for NoSQL.
The API for NoSQL provides optimal performance and feature support for general document-oriented workloads in Azure Cosmos DB.
3
Identify the data model for the social network interaction workload.
The workload requires representing entities as vertices and connections as edges, which is the graph data model supported by the API for Gremlin.
A graph model is required to efficiently query deep relationships and traversals.
4
Review the migration requirements for the legacy retail catalog.
The catalog is built on MongoDB, so migrating to the API for MongoDB allows compatibility with the existing MongoDB wire protocol and drivers.
This avoids code modification for MongoDB-compatible drivers and client libraries.

Anahtar Kavram

Selecting the appropriate Azure Cosmos DB API based on database model compatibility and migration source systems.

Alternatif Yöntem

Instead of evaluating by workload type first, you can filter by API capability (e.g., look for graph, column-family, and document capabilities) and map them back to the source systems.
Tahmini Süre:2m 0s
ÖncekiSayfa 2 / 4Sonraki
Tüm alıştırma soruları — Microsoft Azure Solutions Architect (AZ-305) | Examkin