Tüm alıştırma soruları

1198 soru

Soru 401Soru

A company is designing a shared storage solution for a high-performance financial analysis application. The storage must meet the following requirements:

* The storage must be hosted on Azure Files and require the Premium performance tier to meet strict IOPS and sub-millisecond latency demands.
* The shared file system must survive the outage of a single datacenter zone in the primary region without data loss or downtime.
* In the event of a regional disaster, the data must be recoverable in a secondary Azure region.

Which two actions should you include in the design to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the storage account containing the Premium file shares to use Zone-Redundant Storage (ZRS).; Use Azure File Sync to replicate the Premium file shares to a storage account in the secondary region.

Cevap

Configure the storage account containing the Premium file shares to use Zone-Redundant Storage (ZRS) and use Azure File Sync to replicate the Premium file shares to a storage account in the secondary region.
The correct architecture combines Zone-Redundant Storage (ZRS) to protect against primary region zonal outages, and Azure File Sync to replicate the premium file shares to a secondary region. Because Premium Azure Files only supports LRS and ZRS natively at the storage level, regional redundancy must be achieved using secondary replication tools.

Adım Adım Çözüm

1
Analyze performance and protocol requirements.
Azure Files Premium performance tier (FileStorage account type) is required for low-latency workloads.
This restricts the available replication options to LRS and ZRS, as GRS, GZRS, RA-GRS, and RA-GZRS are not natively supported by the FileStorage account type.
2
Evaluate zone redundancy options.
Zone-Redundant Storage (ZRS) must be selected.
ZRS replicates the files synchronously across three availability zones in the primary region, allowing the shared file system to survive a single zone outage without downtime.
3
Determine regional disaster recovery strategy.
Natively configured geo-replication is not supported on Premium files. An external replication mechanism like Azure File Sync is required.
Azure File Sync can sync files between a local server or virtual machine and an Azure file share in another region, enabling cross-region data availability.

Anahtar Kavram

Premium Azure Files support only LRS and ZRS; geo-redundancy must be implemented via secondary replication mechanisms like Azure File Sync.
Tahmini Süre:2m 30s
Soru 402Soru

An enterprise is designing a disaster recovery (DR) solution from the Germany West Central region to the Germany North region for a mission-critical enterprise resource planning (ERP) system. The system consists of:

* Three web and application VMs hosted on Standard_D4s_v5 instances, each with a total write churn of less than 1 MB/s1\text{ MB/s}.
* One database VM hosted on a Standard_E16s_v5 instance with the following storage configuration:
* Disk 1 (Operating System): Standard SSD (128 GB128\text{ GB}) with a write churn of 0.5 MB/s0.5\text{ MB/s}.
* Disk 2 (Database Data): Premium SSD (1 TB1\text{ TB}) with a write churn of 15 MB/s15\text{ MB/s}.
* Disk 3 (Transaction Logs): Premium SSD (1 TB1\text{ TB}) with a write churn of 58 MB/s58\text{ MB/s}.

The total write churn for the database VM is 73.5 MB/s73.5\text{ MB/s}. The business requirements specify a Recovery Point Objective (RPO) of 15 minutes15\text{ minutes} and a Recovery Time Objective (RTO) of 1 hour1\text{ hour}.

Which disaster recovery replication strategy should you recommend to meet the requirements while ensuring a supported technical configuration?

Cevabı ve açıklamayı göster

Cevap: Replicate the web and application VMs using Azure Site Recovery, and implement native database streaming replication to a standby VM in Germany North for the database tier.

Cevap

Replicate the web and application VMs using Azure Site Recovery, and implement native database streaming replication to a standby VM in Germany North for the database tier.
The correct strategy combines Azure Site Recovery (ASR) for the low-churn web and application VMs and native database replication for the database VM. Azure Site Recovery has an absolute limit of 54 MB/s54\text{ MB/s} write churn per disk, even when using the High Churn replication tier. Because the transaction logs disk has a write churn of 58 MB/s58\text{ MB/s}, the database VM cannot be supported by ASR. Replicating the web/application tier with ASR and using native database replication for the database tier provides a fully supported and reliable disaster recovery solution that meets the RPO and RTO goals.

Adım Adım Çözüm

1
Analyze the disk-level write churn metrics of the database VM.
Disk 3 (Transaction Logs) has a write churn rate of 58 MB/s58\text{ MB/s}.
Azure Site Recovery (ASR) imposes strict thresholds on write churn per disk. Even with the High Churn tier enabled, the maximum supported write churn is 54 MB/s54\text{ MB/s} per disk.
2
Evaluate ASR supportability for the database VM.
Since Disk 3's churn (58 MB/s58\text{ MB/s}) exceeds the 54 MB/s54\text{ MB/s} limit, ASR cannot be used to replicate the database VM.
High churn rates beyond limits prevent replication from keeping up, violating RPO and causing replication health degradation.
3
Select the replication strategy for the low-churn VMs.
Replicate the three web/application VMs (each <1 MB/s< 1\text{ MB/s}) using ASR.
Web/application VMs are well within ASR limits and can easily meet the 15-minute15\text{-minute} RPO and 1-hour1\text{-hour} RTO.
4
Select the replication strategy for the high-churn database tier.
Recommend native database replication (such as PostgreSQL streaming replication) to a target VM in Germany North.
Native database replication bypasses hypervisor-level storage replication limits, supports high transaction churn, and guarantees transactional consistency.

Anahtar Kavram

Azure Site Recovery limits and hybrid database disaster recovery design
Tahmini Süre:3m 0s
Soru 403Soru

Altus Manufacturing is designing an identity security strategy for its Microsoft Entra ID tenant. The organization currently synchronizes its on-premises Active Directory Domain Services (AD DS) user accounts to Microsoft Entra ID. The design team must satisfy the following requirements:
1. Enforce multi-factor authentication (MFA) for all users when accessing cloud applications, utilizing Conditional Access.
2. Require administrators to activate the Global Administrator role only when performing administrative tasks, ensuring access is temporary and audited.
3. Prevent administrative lockout if the tenant experiences an MFA service outage or if a policy is misconfigured.
4. Minimize operational and infrastructure overhead for the hybrid identity architecture.

Which configuration should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Password Hash Synchronization (PHS) for user authentication. Configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the Global Administrator role. Create a Conditional Access policy requiring MFA for all users, but exclude a dedicated, cloud-only emergency access account.

Cevap

Configure Password Hash Synchronization (PHS) for user authentication, configure Microsoft Entra Privileged Identity Management (PIM) with eligible assignments for the Global Administrator role, and create a Conditional Access policy requiring MFA for all users while excluding a dedicated, cloud-only emergency access account.
The configuration using Password Hash Synchronization (PHS) provides the lowest overhead for hybrid identity compared to Active Directory Federation Services (AD FS). Using Microsoft Entra Privileged Identity Management (PIM) with eligible role assignments enables just-in-time (JIT) access for Global Administrators. Excluding a dedicated, cloud-only emergency access account from the Conditional Access policy prevents tenant lockout in case of MFA service outages or misconfigurations.

Adım Adım Çözüm

1
Evaluate the hybrid identity authentication method based on operational overhead.
Select Password Hash Synchronization (PHS) as it requires no additional on-premises servers or federation infrastructure, unlike Active Directory Federation Services (AD FS).
To satisfy the requirement of minimizing operational and infrastructure overhead.
2
Determine the appropriate Privileged Identity Management (PIM) role assignment type.
Configure the Global Administrator role assignments as eligible rather than active.
To enforce Just-In-Time (JIT) activation and ensure users do not have standing administrative privileges.
3
Design the Conditional Access policy and lockout prevention strategy.
Enforce MFA for all users, but explicitly exclude a dedicated, cloud-only emergency access account from the policy.
To prevent tenant lockout if standard MFA mechanisms are unavailable or if a policy misconfiguration occurs.

Anahtar Kavram

Designing secure Entra ID access with PIM, PHS, and Conditional Access exclusion policies for emergency accounts.
Soru 404Soru

You are designing a global routing solution for a web application hosted in multiple Azure regions. The solution must support automatic failover to a secondary region and offload SSL/TLS decryption to the edge closest to the users. Which Azure service should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure Front Door

Cevap

Azure Front Door
Azure Front Door is a global, scalable entry-point that uses the Microsoft global edge network to host web applications. It supports Anycast DNS, SSL/TLS termination at the edge, and automatic regional failover, matching the requirements of the scenario.

Adım Adım Çözüm

1
Identify the application layer requirements.
The application requires SSL/TLS termination at the edge and automatic global failover.
These requirements specify a global Layer 7 load balancing solution.
2
Compare global routing options in Azure.
Azure Front Door is a Layer 7 global service that operates at the edge, while Azure Traffic Manager is a Layer 4/DNS-based service.
DNS-based load balancers cannot perform SSL decryption or path-based routing as they do not inspect HTTP/HTTPS payloads.
3
Select the correct service.
Azure Front Door provides edge-based SSL termination and automatic global failover.
It fulfills all the architectural requirements.

Anahtar Kavram

Distinguishing between DNS-based routing (Traffic Manager) and Anycast Layer 7 routing (Front Door) for global web applications requiring SSL offloading.
Tahmini Süre:45s
Soru 405Soru

A retail company wants to delegate management of Azure SQL databases in a specific resource group named 'SQL-Prod-RG' to a database operations team. The security team has defined the following requirements for this delegation:

- Access must be granted using the principle of least privilege.
- Administrative overhead must be minimized when onboarding or offboarding team members.
- Access must not be persistent; team members must request access on-demand for a limited duration.

Which of the following strategies should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group containing the database operations team eligible for the SQL Server Contributor role at the SQL-Prod-RG resource group scope.

Cevap

Configure Microsoft Entra Privileged Identity Management (PIM) to make a Microsoft Entra ID security group containing the database operations team eligible for the SQL Server Contributor role at the SQL-Prod-RG resource group scope.
The correct strategy combines a Microsoft Entra ID security group to minimize operational overhead, the SQL Server Contributor role scoped to the SQL-Prod-RG resource group to follow the principle of least privilege, and Microsoft Entra Privileged Identity Management (PIM) eligibility to ensure access is only active on-demand for a limited duration.

Adım Adım Çözüm

1
Select the correct identity principal to minimize administrative overhead.
A Microsoft Entra ID security group is used to manage the members of the database operations team.
Directly assigning roles to user accounts creates administrative overhead as team members join or leave.
2
Select the appropriate role and scope to follow the principle of least privilege.
The SQL Server Contributor role is scoped to the SQL-Prod-RG resource group.
Subscription-level assignments or high-privilege roles like Owner violate the least privilege principle when only SQL database management in a specific resource group is needed.
3
Select the appropriate access activation mechanism to meet the non-persistence requirement.
Configure the security group's PIM assignment as eligible.
Eligible assignments require users to request activation on-demand, whereas active assignments grant persistent access, violating the security requirement.

Anahtar Kavram

Azure RBAC delegation combined with Microsoft Entra Privileged Identity Management (PIM) group eligibility and resource group scoping to achieve scalable, least-privilege, and time-bound access control.
Soru 406Soru

An organization is planning to migrate two on-premises SQL Server workloads to Azure. You need to design a relational database solution that minimizes administrative overhead. The workloads have the following requirements:

* Workload 1: Requires SQL Server Agent to run scheduled jobs, uses CLR features, and requires cross-database queries.
* Workload 2: Has highly unpredictable traffic with long periods of inactivity. It requires automatic scaling of compute resources based on demand.

Which two Azure SQL options should you recommend to support these workloads? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance for Workload 1; Azure SQL Database (Serverless) for Workload 2

Cevap

Azure SQL Managed Instance for Workload 1 and Azure SQL Database (Serverless) for Workload 2
The correct options are the ones recommending Azure SQL Managed Instance for Workload 1 and Azure SQL Database (Serverless) for Workload 2. Azure SQL Managed Instance is a PaaS database service that supports instance-level features like SQL Server Agent and native cross-database queries, which are required for Workload 1. Azure SQL Database (Serverless) automatically scales compute based on workload demand and pauses the database during inactive periods, matching the requirements of Workload 2 while minimizing administrative overhead and cost.

Adım Adım Çözüm

1
Analyze the requirements for Workload 1
Workload 1 requires SQL Server Agent, CLR, and cross-database queries. These legacy SQL Server features require either SQL Server on Azure VMs or Azure SQL Managed Instance. Since the solution must minimize administrative overhead, Azure SQL Managed Instance (PaaS) is selected over SQL Server on Azure VMs (IaaS).
To identify the best PaaS offering that supports the required database engine features.
2
Analyze the requirements for Workload 2
Workload 2 has highly unpredictable traffic with periods of inactivity, requiring automatic scaling. Azure SQL Database (Serverless) satisfies this by scaling compute dynamically and pausing during inactive periods.
To select the database tier that matches the traffic pattern and minimizes cost and administrative overhead.

Anahtar Kavram

Selecting the appropriate Azure SQL deployment option and tier based on feature compatibility (SQL Agent, CLR, cross-db queries), scaling needs, and administrative overhead constraints.
Tahmini Süre:1m 30s
Soru 407Soru

You are a Solutions Architect designing a data migration and modernization strategy for an enterprise. You need to map several application workloads and legacy databases to the most appropriate Azure Cosmos DB API based on their data model, query requirements, and migration constraints. Match each workload scenario on the left with the correct Azure Cosmos DB API on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

A legacy tabular database storing time-series sensor logs must be migrated from an Apache Cassandra cluster. The solution must support existing Cassandra Query Language (CQL) queries and driver configurations with minimal code modifications.
A social network application requires a database that can store complex relationships between users, pages, and posts. The solution must support low-latency graph traversals and queries utilizing vertices and edges.
A product catalog storing hierarchical JSON documents must be migrated from an on-premises MongoDB replica set. The solution must maintain compatibility with existing MongoDB query operators and drivers.
A new order processing application requires a transactional store with full support for SQL-like queries, schema-agnostic indexing, and server-side programming via JavaScript stored procedures.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Legacy Cassandra workloads match to Azure Cosmos DB for Apache Cassandra; Graph workloads match to Azure Cosmos DB for Apache Gremlin; Legacy MongoDB workloads match to Azure Cosmos DB for MongoDB; Native SQL-based transactional document workloads match to Azure Cosmos DB for NoSQL.
The correct matches align the workload migration requirements and data models with the corresponding Azure Cosmos DB APIs. Apache Cassandra workloads map to the Cassandra API to preserve CQL compatibility; graph workloads map to the Gremlin API for vertices/edges traversals; MongoDB document models map to the MongoDB API to preserve driver and operator compatibility; and native SQL-based transactional document workloads map to the NoSQL API.

Adım Adım Çözüm

1
Analyze the legacy data store and compatibility requirements for the first scenario, which mentions an Apache Cassandra database, CQL queries, and Cassandra driver configurations.
Identify that Azure Cosmos DB for Apache Cassandra is wire-protocol compliant and preserves CQL compatibility.
This avoids code rewrites for Cassandra driver-based applications.
2
Analyze the query and model requirements for the second scenario, which specifies low-latency graph traversals, relationships, vertices, and edges.
Identify that Azure Cosmos DB for Apache Gremlin is the graph-optimized API supporting Apache TinkerPop and Gremlin queries.
Other APIs do not natively support graph-specific traversal mechanics.
3
Analyze the document structure and driver compatibility requirements for the third scenario, which highlights hierarchical JSON documents and MongoDB query operators.
Identify that Azure Cosmos DB for MongoDB provides the required wire protocol compatibility for MongoDB applications.
This allows existing MongoDB applications to run on Cosmos DB without code modification.
4
Analyze the requirements for the new transactional application in the fourth scenario, focusing on SQL queries, server-side JavaScript execution, and schema-agnostic indexing.
Identify that Azure Cosmos DB for NoSQL is the native document API providing these capabilities.
The NoSQL API natively supports SQL query dialect and server-side JavaScript programming.

Anahtar Kavram

Selecting the appropriate Azure Cosmos DB API based on database compatibility, data structure, and query language capabilities.
Tahmini Süre:2m 0s
Soru 408Soru

A retail organization hosts its main loyalty transaction database on a single database in Azure SQL Database (Business Critical tier) in the East US region. You are designing a disaster recovery (DR) solution that replicates the database to the West US region. The solution must meet the following requirements:
* Database failover to the secondary region must be initiated manually by the operations team.
* Reporting applications must be able to query the secondary replica using a single, constant connection endpoint that does not require reconfiguration or connection string updates after a failover.

Which configuration should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Failover Group containing the database, set the read-write failover policy to manual, and configure the reporting applications to use the read-only listener endpoint.

Cevap

Configure a Failover Group containing the database, set the read-write failover policy to manual, and configure the reporting applications to use the read-only listener endpoint.
A Failover Group provides a stable read-only listener endpoint that automatically routes read traffic to the secondary database replica. By setting the failover policy to manual, the operations team retains control over initiating database failover while allowing the application connection strings to remain unchanged.

Adım Adım Çözüm

1
Analyze the high availability and disaster recovery requirements.
Identified that the secondary replica must reside in West US, failover must be manual, and reporting applications require a single connection endpoint that remains constant during failover.
Understanding the constraints is necessary to select the correct replication technology and configuration options.
2
Compare replication options for Azure SQL Database.
Failover Groups provide a read-only listener endpoint that remains constant across failovers, whereas Active Geo-replication requires updating the connection strings to the specific server names after failover.
This determines that a Failover Group is required to satisfy the endpoint stability requirement.
3
Configure the failover policy of the Failover Group.
Setting the read-write failover policy to manual meets the requirement of allowing the operations team to manually initiate the failover.
An automatic failover policy would violate the operational control requirement.

Anahtar Kavram

Azure SQL Database Failover Groups allow grouping databases for replication and failover, offering read-write and read-only listener endpoints that survive failover events, with support for both automatic and manual failover policies.
Tahmini Süre:1m 30s
Soru 409Soru

An online multiplayer gaming platform is designing a telemetry analytics pipeline on Azure to ingest game session event logs. The platform needs to store raw events in JSON format and enable data analysts to run ad-hoc exploratory SQL queries on the files. The data volume fluctuates significantly, and the platform wants to avoid paying for compute resources when queries are not executing. Additionally, the storage solution must survive a regional datacenter outage, and the legacy ingestion service must authenticate to the storage account using a Shared Access Signature (SAS) token with a lifetime of no more than 4 hours.

Which of the following components should you include in the architecture to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Synapse Analytics serverless SQL pools to query the JSON files; Azure Data Lake Storage Gen2 configured with Geo-Redundant Storage (GRS)

Cevap

Azure Synapse Analytics serverless SQL pools and Azure Data Lake Storage Gen2 configured with Geo-Redundant Storage (GRS)
The design calls for ad-hoc exploratory queries on JSON data directly in the data lake without paying for idle resources, making serverless SQL pools the optimal selection as they scale dynamically and bill based on data processed. The requirement to survive a regional datacenter outage is met by selecting Geo-Redundant Storage (GRS), which replicates the files to a paired secondary region.

Adım Adım Çözüm

1
Evaluate query requirement
Azure Synapse Analytics serverless SQL pools
Since the queries are exploratory and ad-hoc with fluctuating volume, a serverless model is cost-effective and charges only per terabyte of data processed without persistent cluster overhead.
2
Evaluate regional outage resilience requirement
Azure Data Lake Storage Gen2 with Geo-Redundant Storage (GRS)
GRS replicates data asynchronously to a secondary region, ensuring disaster recovery against primary region outages.

Anahtar Kavram

Designing serverless analytical query mechanisms coupled with geo-replicated storage to satisfy cost, performance, and disaster recovery SLA constraints.
Tahmini Süre:2m 30s
Soru 410Soru

A logistics company is designing an Azure storage infrastructure for a new IoT telemetry analysis and reporting application. The application has the following design requirements:

* Telemetry data must be stored in a cost-effective storage tier. The data is rarely accessed after 3030 days, but must be retained for 77 years for compliance. A rehydration latency of up to 1515 hours is acceptable when retrieving this archival data.
* Multiple containerized application servers running on Linux require concurrent read-write access to a shared file system via the NFS protocol.
* The report metadata database, which runs on an Azure Virtual Machine, requires a persistent managed disk with a capacity of 4 TiB4\text{ TiB} that must deliver at least 15000 IOPS15{}000\text{ IOPS} and sub-millisecond latency.

Which of the following design decisions should you recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the telemetry data in Azure Blob storage and implement a lifecycle management policy to transition the blobs to the Archive tier after 30 days.; Provision a Premium Azure Files share to support the NFS-based shared file system.

Cevap

Store the telemetry data in Azure Blob storage with a lifecycle management policy to transition the blobs to the Archive tier after 30 days, and provision a Premium Azure Files share to support the NFS-based shared file system.
Storing telemetry in Azure Blob storage combined with an Archive tier lifecycle transition meets the compliance, retention, and cost requirements while respecting the rehydration time limit. Deploying a Premium Azure Files share is the correct choice because NFS v4.1 support is only available in the Premium tier of Azure Files.

Adım Adım Çözüm

1
Analyze the requirements for telemetry data storage and identify the appropriate storage tier and lifecycle behavior.
Determine that Azure Blob storage with a lifecycle transition to the Archive tier after 3030 days is ideal, as the Archive tier accommodates the 1515-hour retrieval latency requirement at the lowest cost.
The Archive tier is designed for data that is rarely accessed and can tolerate retrieval latencies of up to several hours.
2
Evaluate the file share protocol requirements for the Linux containers.
Identify that a Premium Azure Files share is required to support the NFS v4.1 protocol.
Standard Azure Files shares support only SMB and REST protocols. NFS is exclusive to Premium Azure Files.
3
Assess the performance characteristics of the database disk.
Discard the use of Standard SSD or Standard HDD because they cannot provide 15000 IOPS15{}000\text{ IOPS} and sub-millisecond latency.
High-throughput and low-latency database workloads require Premium SSD, Premium SSD v2, or Ultra Disk.

Anahtar Kavram

Selecting and configuring appropriate Azure storage services (Blob, Files, and Disks) based on protocol, performance, cost, and lifecycle requirements.
Soru 411Soru

An organization is designing a hybrid traffic routing and failover strategy for two distinct global workloads:
1. A global web application running on HTTP that requires SSL offloading and URL path-based routing.
2. A legacy TCP-based service that requires global DNS-based failover.

Which of the following Azure services should you include in the design to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Front Door to provide Anycast-based routing, SSL offloading, and URL path-based routing for the web application; Azure Traffic Manager to provide DNS-based routing and failover for the legacy TCP service

Cevap

The correct services are Azure Front Door for the HTTP web application and Azure Traffic Manager for the legacy TCP service.
The design requires two different routing mechanisms. The global HTTP application needs layer 7 intelligence, which is provided by Azure Front Door using Anycast routing, path-based rules, and edge SSL termination. The legacy TCP service does not use HTTP, so it requires a protocol-agnostic DNS routing mechanism, which is provided by Azure Traffic Manager.

Adım Adım Çözüm

1
Analyze the requirements for the global HTTP application, which include SSL offloading and URL path-based routing.
Azure Front Door is selected because it is a global, Anycast-based layer 7 load balancer capable of terminating SSL and routing based on URL paths.
Only layer 7 load balancers with global reach can satisfy HTTP-specific routing rules and SSL offloading at the network edge.
2
Analyze the requirements for the legacy TCP-based service, which require global DNS-based failover.
Azure Traffic Manager is selected because it operates at the DNS level and can distribute non-HTTP TCP traffic globally.
Since the legacy service is non-HTTP TCP, HTTP-specific load balancers cannot handle the traffic, making DNS-based global routing the appropriate choice.

Anahtar Kavram

Contrasting global Anycast-based layer 7 routing (Azure Front Door) with global DNS-based routing (Azure Traffic Manager) depending on workload protocol and capability requirements.
Soru 412Soru

A logistics company is designing an identity governance and privileged access solution for its Azure environment. The company needs to grant a team of cloud administrators temporary, approved Contributor rights on target subscriptions.

The solution must meet the following requirements:
- Cloud administrators must only receive Contributor access on-demand when actively performing tasks, with access automatically revoking after 4 hours.
- Every request to elevate access must enforce multi-factor authentication (MFA) and require the user to provide a business justification.
- Access rights must be managed using a scalable administrative model that avoids configuring permissions for individual user accounts.
- Emergency-access (break-glass) accounts must be protected from accidental lockout caused by strict Conditional Access policies requiring MFA.

Which two actions should you include in the design to meet these requirements? Select two.

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Microsoft Entra security group containing the cloud administrators, and assign this group as eligible for the Contributor role using Microsoft Entra Privileged Identity Management (PIM).; Configure the Microsoft Entra Privileged Identity Management (PIM) role activation settings for the Contributor role to require multi-factor authentication (MFA), require justification, and set the maximum activation duration to 4 hours.

Cevap

To meet the governance and administrative constraints, you should create a Microsoft Entra security group containing the cloud administrators and assign the group as eligible for the Contributor role using Microsoft Entra Privileged Identity Management (PIM), and configure the PIM role activation settings for the Contributor role to require multi-factor authentication (MFA), require justification, and set the maximum activation duration to 4 hours.
To design a secure administrative model that scales, permissions should be assigned to a Microsoft Entra security group. To enforce Just-In-Time (JIT) access, this group must be designated as eligible (rather than active) for the Contributor role within Privileged Identity Management (PIM). Additionally, to enforce constraints such as MFA, justification, and a maximum activation window of 4 hours, these rules must be defined within the PIM role activation settings for the Contributor role.

Adım Adım Çözüm

1
Analyze administrative scalability and permission assignment rules.
Conclude that administrators should be managed collectively via a Microsoft Entra security group rather than applying direct assignments to individual user accounts.
Direct assignment to individual accounts increases administrative overhead and complicates access review processes.
2
Address the Just-In-Time (JIT) access and approval requirement.
Ensure the group is configured with an 'eligible' assignment type in PIM, and configure role activation settings to enforce MFA, justification, and a maximum duration of 4 hours.
Active assignments provide permanent standing access, whereas eligible assignments require explicit activation that is subject to governance constraints.
3
Address emergency access and lockout protection guidelines.
Ensure emergency-access (break-glass) accounts are explicitly excluded from MFA policies that could lock out all administrators during an Entra ID or MFA outage.
Excluding emergency accounts preserves a secure recovery path in critical situations.

Anahtar Kavram

Microsoft Entra Privileged Identity Management (PIM) configuration and best practices for role eligibility and group-based assignments.
Soru 413Soru

You are designing a backup solution for a production SAP HANA database running on Azure Virtual Machines. You also need to back up the underlying Virtual Machines to allow rapid recovery of the OS and application configuration. The solution must satisfy the following requirements:
- Database transaction log backups must run every 1515 minutes to meet the database Recovery Point Objective (RPO).
- VM-level recovery points must support instant restore capabilities for up to 1414 days.
- All backup data must remain available even in the event of a primary Azure region failure.
- Storage costs for long-term backups must be minimized by archiving weekly full backups older than 180180 days to the Vault-archive tier.

Which configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create a Recovery Services vault configured with Geo-Redundant Storage (GRS). Associate the database with a SAP HANA backup policy that runs log backups every 1515 minutes and tiers weekly full backups to the Vault-archive tier after 180180 days. Associate the Virtual Machines with an Enhanced VM backup policy that has instant restore retention set to 1414 days.

Cevap

Create a Recovery Services vault configured with Geo-Redundant Storage (GRS). Associate the database with a SAP HANA backup policy that runs log backups every 1515 minutes and tiers weekly full backups to the Vault-archive tier after 180180 days. Associate the Virtual Machines with an Enhanced VM backup policy that has instant restore retention set to 1414 days.
The correct configuration uses a Recovery Services vault with GRS to ensure backup availability across regions. To meet the 1414-day instant restore requirement for VMs, an Enhanced VM backup policy is required because standard policies only support up to 55 days of instant restore snapshot retention. Additionally, only full database backups can be tiered to the Vault-archive tier after 180180 days, while log backups remain in the standard vault tier to support database recovery operations.

Adım Adım Çözüm

1
Determine the vault type and storage redundancy required.
A Recovery Services vault with GRS is selected.
SAP HANA and Azure VM backups must be stored in a Recovery Services vault. GRS is required to ensure backup data remains available if the primary region fails.
2
Determine the virtual machine backup policy type based on the instant restore retention requirement.
The Enhanced VM backup policy is selected.
The Standard VM backup policy only supports instant restore retention up to 55 days. The Enhanced policy is required to support 1414 days of instant restore retention.
3
Determine the database backup policy and tiering strategy.
A SAP HANA backup policy is configured with log backups running every 1515 minutes, and only the weekly full backups are tiered to the Vault-archive tier after 180180 days.
Only full backups are eligible for archiving to the Vault-archive tier, which matches the cost-optimization requirement for long-term retention.

Anahtar Kavram

Designing Azure Backup solutions by choosing the correct vault tier, policy type, storage redundancy, and archiving options for workload backups.
Soru 414Soru

An enterprise is deploying a global fleet-tracking system for international cargo ships to monitor fuel efficiency and environmental metrics. The database must support a write-intensive workload with an 80:2080:20 write-to-read ratio, ingesting data globally across the East US, West Europe, and East Asia regions. The system requires sub-10ms latency for both reads and writes, a 99.999%99.999\% availability SLA for both read and write operations, and must survive regional datacenter outages without data loss. Additionally, database backup data must be resilient against regional disasters. Which two configurations should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Azure Cosmos DB account to use multi-region writes across East US, West Europe, and East Asia.; Partition the Cosmos DB container using a high-cardinality composite key consisting of the ship identifier and the transmission hour.

Cevap

To meet the requirements, you must configure the Azure Cosmos DB account to use multi-region writes and partition the container using a high-cardinality composite key of the ship identifier and transmission hour.
Enabling multi-region writes ensures writes are processed locally in East US, West Europe, and East Asia, keeping latency under 10ms and fulfilling the 99.999% SLA. A high-cardinality composite key of the ship identifier and transmission hour spreads data and Request Units (RUs) uniformly across physical partitions to accommodate the write-intensive telemetry stream.

Adım Adım Çözüm

1
Evaluate the latency and availability SLA requirements.
To achieve sub-10ms write latency globally and a 99.999%99.999\% read/write availability SLA, the system must write to local regional endpoints rather than routing all writes to a single primary region.
Multi-region writes in Azure Cosmos DB satisfy the latency limit and elevate the write availability SLA to 99.999%99.999\%.
2
Determine the partitioning strategy to avoid hot partitions.
Select a high-cardinality partition key that distributes writes uniformly across partitions over time.
Using a composite key like ship identifier and transmission hour ensures write operations are evenly spread, avoiding the bottlenecks of low-cardinality keys.
3
Analyze backup redundancy needs under disaster recovery constraints.
Discard Locally Redundant Storage (LRS) for backups and ensure geo-redundant or zone-redundant storage is configured.
LRS keeps data in a single facility and cannot survive regional datacenter outages, failing the disaster resilience goal.

Anahtar Kavram

Azure Cosmos DB multi-region writes, high-cardinality partitioning, and backup redundancy options for high-availability globally distributed databases.
Soru 415Soru

A multinational logistics provider requires a containerized architecture to process international package shipments across two distinct geographic regions: Europe and North America. The solution must adhere to the following design constraints:

* Event-driven scaling: Individual container instances must scale dynamically from 00 to a high volume of concurrent instances based on the message volume in an Azure Service Bus queue.
* Minimal operational complexity: The cloud architecture team has no dedicated container orchestration administrators and wants to avoid managing virtual machine nodes, orchestrator control planes, or complex deployment manifests.
* Compliance and governance: Regional package processing telemetry and event logs must remain strictly within their origin region to comply with local data sovereignty laws.

Which infrastructure design meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy Azure Container Apps in both regions, and configure them to send telemetry to separate regional Log Analytics workspaces.

Cevap

Deploy Azure Container Apps in both regions, and configure them to send telemetry to separate regional Log Analytics workspaces.
Deploying Azure Container Apps in both regions configured with regional Log Analytics workspaces is correct. Azure Container Apps is a serverless platform that supports event-driven autoscaling (including scaling to 00) using KEDA natively, eliminating the operational complexity of managing Kubernetes clusters. Utilizing regional Log Analytics workspaces ensures that telemetry and logs remain within their respective regions, satisfying the data sovereignty requirements.

Adım Adım Çözüm

1
Evaluate the scaling and operational requirements.
The workload requires event-driven scaling to 00 based on queue depth with minimal administrative overhead.
This rules out Azure Kubernetes Service (AKS) due to high management complexity, and Azure Container Instances (ACI) because it lacks native KEDA scaling integration.
2
Evaluate the logging and compliance requirements.
Telemetry and event logs must reside strictly within their region of origin to comply with data sovereignty laws.
This rules out a centralized Log Analytics workspace, necessitating separate workspaces for each region.
3
Select the optimal Azure services that fulfill all requirements.
Azure Container Apps deployed with regional Log Analytics workspaces matches all constraints.
Azure Container Apps natively supports KEDA-based scale-to-zero without cluster management overhead, and regional Log Analytics workspaces preserve data residency.

Anahtar Kavram

Azure container services selection and regional log configuration based on operational complexity and data sovereignty rules.
Soru 416Soru

An organization is deploying a public-facing retail web application on Azure Virtual Machines. To ensure business continuity during localized datacenter outages, the compute tier requires a virtual machine uptime SLA of 99.99%99.99\%. Which deployment strategy should you recommend to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machines across two or more Availability Zones in the same Azure region.

Cevap

Deploy the virtual machines across two or more Availability Zones in the same Azure region.
Deploying virtual machines across two or more Availability Zones in the same Azure region is the correct choice because Azure guarantees a 99.99%99.99\% virtual machine uptime SLA for this configuration. Availability Zones are physically separate datacenters within an Azure region, equipped with independent power, cooling, and networking, which protects the application from datacenter-level failures.

Adım Adım Çözüm

1
Identify the high availability and SLA requirements.
The application requires protection against datacenter-level outages (zone failures) and a virtual machine uptime SLA of 99.99%99.99\%.
This establishes the minimum architectural tier required for compute resources.
2
Evaluate the SLA and resilience characteristics of Azure compute deployment options.
Availability Zones provide a 99.99%99.99\% SLA and protect against datacenter outages by isolating workloads in distinct physical locations within a region. Availability Sets provide a 99.95%99.95\% SLA and only protect against hardware failures within a single datacenter.
This filters out configurations that do not meet the minimum SLA target of 99.99%99.99\%.
3
Select the option that matches the 99.99%99.99\% SLA and zone-redundant requirements.
Deploying the virtual machines across two or more Availability Zones in the same region is the correct architecture.
It is the only standard Azure compute configuration that guarantees a 99.99%99.99\% VM uptime SLA.

Anahtar Kavram

Azure Availability Zones provide the highest single-region compute high availability with a 99.99%99.99\% SLA, protecting workloads from localized datacenter failures.
Soru 417Soru

AeroSpire Aviation is designing a business continuity solution for an aviation telemetry ingestion system. The system writes flight data to an Azure Storage account configured with Read-Access Geo-Redundant Storage (RA-GRS). The primary region is East US, and the secondary region is West US.

During a simulated disaster recovery drill, the primary region experiences a complete service outage. The design team is evaluating the system's behavior during the outage and during a subsequent customer-managed failover.

Which of the following statements regarding the behavior of the storage account and the application are true? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Before the failover is initiated, the application can continue to read telemetry data using the secondary endpoint, but cannot write new data.; When the customer-managed failover is initiated, the storage account type is automatically converted to Locally Redundant Storage (LRS) in the new primary region.

Cevap

Prior to failover, the application can only read from the secondary endpoint and cannot write to it. Once a customer-managed failover is initiated, the storage account is converted to Locally Redundant Storage (LRS) in the new primary region.
The correct options state that the secondary endpoint is read-only prior to failover, and that the account changes to Locally Redundant Storage (LRS) in the new primary region upon failover. This accurately reflects the design and operational behavior of Read-Access Geo-Redundant Storage (RA-GRS) accounts under failure scenarios.

Adım Adım Çözüm

1
Analyze read/write behavior of RA-GRS during primary outage
The primary endpoint is unavailable for reads and writes. The secondary endpoint is available for read-only access. Thus, reads can continue via the secondary endpoint, but writes fail.
RA-GRS stands for Read-Access Geo-Redundant Storage, which provides a read-only endpoint in the secondary region.
2
Determine the state of the storage account after customer-managed failover
The secondary region (West US) becomes the new primary region, and the redundancy configuration changes to Locally Redundant Storage (LRS).
Azure automatically demotes the storage account to LRS in the new primary region during failover because the original primary is assumed to be unavailable or down.
3
Assess post-failover geo-replication tasks
The storage account remains as LRS and does not automatically replicate back to East US. A manual configuration change is required to re-establish geo-replication once the original primary region is healthy.
Azure does not automatically configure replication to prevent unwanted costs and write conflicts.

Anahtar Kavram

Azure Storage account customer-managed failover behavior and replication tiers
Soru 418Soru

A healthcare provider plans to host a new medical record system in Azure. The database layer consists of three databases that must perform cross-database transactions using the three-part naming convention. The system requires SQL Server Agent for scheduling maintenance tasks. To comply with regulatory standards, the database environment must be isolated within a private subnet, and the provider wants to minimize the effort required to manage operating system updates and database engine patches.

Which relational database solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Database Managed Instance

Cevap

Azure SQL Database Managed Instance
Azure SQL Database Managed Instance is a fully managed relational database service (PaaS) that minimizes the effort required to patch the operating system and SQL Server engine. It natively supports SQL Server Agent, native cross-database queries using three-part names, and is designed to be deployed into a private subnet within an Azure Virtual Network.

Adım Adım Çözüm

1
Analyze compatibility and feature requirements.
The solution requires SQL Server Agent and native cross-database transactions. This rules out Azure SQL Database single database and Azure SQL Database elastic pools, as they do not support these features natively.
Identifying mandatory feature requirements narrows down the valid Azure SQL deployment options.
2
Analyze network isolation and management overhead requirements.
The solution must support private subnet deployment (VNet injection) and minimize administrative patching overhead. SQL Server on Azure VMs supports the features but has high patching overhead (IaaS). Azure SQL Database Managed Instance supports VNet injection and is fully managed (PaaS).
Evaluating administrative overhead and network constraints helps distinguish between IaaS (virtual machines) and PaaS (Managed Instance) options.
3
Select the optimal database service.
Azure SQL Database Managed Instance meets all functional, network isolation, and low administrative overhead requirements.
Managed Instance combines the feature compatibility of SQL Server with the fully managed benefits of Azure SQL Database.

Anahtar Kavram

Selecting the appropriate Azure SQL relational database deployment option based on feature compatibility, network isolation, and management overhead.
Soru 419Soru

Apex Autonomy is designing a secure identity and access management strategy in Microsoft Entra ID. You need to match the specific security and operational access requirements to the corresponding Microsoft Entra Conditional Access settings.

To answer, match each security requirement on the left to the correct Conditional Access setting on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Require external contractors to use phishing-resistant multi-factor authentication (MFA) when accessing sensitive source code repositories.
Prevent users from copying, pasting, or downloading files when they access Exchange Online from unmanaged personal devices.
Force administrators to re-authenticate if they attempt to access the Azure portal after their session has been active for more than 4 hours.
Block access to the enterprise resource planning (ERP) system if a user attempts to log in from a location not defined by IP ranges or GPS coordinates.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

To satisfy the security requirements:
- Requiring phishing-resistant MFA is accomplished by selecting the Grant controls: Require authentication strength setting.
- Restricting actions like downloading or copying files on unmanaged devices is achieved via the Session controls: Use Conditional Access App Control setting.
- Forcing administrative re-authentication after a set period is controlled by the Session controls: Sign-in frequency setting.
- Restricting access based on coordinates or IP ranges uses the Conditions: Location setting.
Each security requirement aligns with a specific component of a Microsoft Entra Conditional Access policy. Re-authentication frequency is managed through the Sign-in frequency session control. Control over device actions such as preventing downloads requires Session controls integrated with Microsoft Defender for Cloud Apps. Phishing-resistant MFA is enforced via Authentication strength in Grant controls. Geolocation or IP limits are managed via Location conditions.

Adım Adım Çözüm

1
Analyze the first requirement for enforcing phishing-resistant MFA.
Identify that configuring specific MFA methods (like FIDO2 keys) is handled by Authentication Strength.
Authentication strength is a Grant control configuration that defines which authentication methods are acceptable for a user to access a resource.
2
Analyze the second requirement for preventing file downloads/copying on unmanaged devices.
Identify that restricting in-app actions requires session monitoring and enforcement via Microsoft Defender for Cloud Apps integration.
Conditional Access App Control is a Session control that proxies the web session to restrict real-time user activities like file downloads.
3
Analyze the third requirement for forcing administrator re-authentication after a set time.
Identify the setting that controls session duration lifetime.
Sign-in frequency is a Session control that sets the maximum time a session can remain valid before requiring new credential inputs.
4
Analyze the fourth requirement for restricting access based on geographical boundaries.
Identify the policy evaluation criterion for network origin.
The Location condition evaluates the IP or GPS position of the incoming request to determine whether to apply the policy rules.

Anahtar Kavram

Microsoft Entra ID Conditional Access controls and conditions mapping
Tahmini Süre:2m 0s
Soru 420Soru

An enterprise is designing a subscription governance strategy for a multi-region deployment. The compliance team requires that database administrators are only allowed to manage database resources in the 'DB-Prod-RG' resource group. Additionally, the database administrators should only receive these privileges when actively performing maintenance tasks, and all permissions must be audit-compliant and managed centrally to reduce administrative overhead.

Which two configurations should you include in the design to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Microsoft Entra ID security group containing the database administrator user accounts, and assign roles to the group instead of individual users.; Configure Microsoft Entra Privileged Identity Management (PIM) to make the security group eligible for the SQL DB Contributor role at the 'DB-Prod-RG' resource group scope.

Cevap

The correct configurations are to create a Microsoft Entra ID security group containing the database administrator user accounts, and configure Microsoft Entra Privileged Identity Management (PIM) to make the group eligible for the SQL DB Contributor role at the 'DB-Prod-RG' resource group scope.
Assigning roles to a Microsoft Entra security group reduces administrative overhead and ensures governance scales effectively. Using Microsoft Entra Privileged Identity Management (PIM) with an eligible role assignment at the resource group scope enables database administrators to request just-in-time (JIT) access specifically for database maintenance tasks, adhering to the principle of least privilege.

Adım Adım Çözüm

1
Identify the governance requirements for delegation, scope, and just-in-time access.
Database administrators need access restricted to the 'DB-Prod-RG' resource group, active only during maintenance, with low administrative overhead.
This defines the target scope, role assignment type, and group management strategy.
2
Apply identity governance best practices for administrative scale.
Create a Microsoft Entra security group for the database administrators to avoid direct role assignments to individual users.
Direct assignments to user accounts violate best practices and increase administrative complexity.
3
Configure the role assignment method and scope.
Configure Microsoft Entra Privileged Identity Management (PIM) with an eligible assignment for the group at the resource group scope.
An eligible assignment ensures just-in-time (JIT) activation for maintenance, while the resource group scope restricts access to the specified database resources.

Anahtar Kavram

Azure RBAC and Subscription Governance
ÖncekiSayfa 21 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Solutions Architect (AZ-305) | Examkin