Tüm alıştırma soruları

1198 soru

Soru 521Soru

A logistics company is designing the Azure infrastructure for a new core order-tracking application. The application will run on Azure Virtual Machines, requires a 99.99%99.99\% availability SLA, and must remain operational even if a primary datacenter within the Azure region experiences a power outage. Which virtualization deployment strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy standard Azure Virtual Machines distributed across multiple Availability Zones in the region.

Cevap

Deploy standard Azure Virtual Machines distributed across multiple Availability Zones in the region.
Deploying standard virtual machines across multiple Availability Zones provides independent physical locations within a region, protecting the application from datacenter-level power outages and enabling a 99.99% SLA.

Adım Adım Çözüm

1
Analyze the availability and disaster resilience requirements.
The application requires a 99.99% availability SLA and must survive a power outage at a primary datacenter.
This rules out single datacenter (single zone) deployments and single VM solutions.
2
Evaluate the workload stability requirements.
The application is a core order-tracking system, representing a steady-state production workload.
This rules out Azure Spot VMs due to the risk of eviction.
3
Select the appropriate deployment architecture.
Deploying standard virtual machines across multiple Availability Zones provides zone redundancy and satisfies the 99.99% SLA.
Availability Zones physically isolate workloads across separate datacenters with independent power, cooling, and networking within a region.

Anahtar Kavram

Designing high-availability compute solutions using Availability Zones
Tahmini Süre:1m 0s
Soru 522Soru

An enterprise is designing the storage architecture for two new applications:

1. App1 stores high-throughput transactional logging data using a Premium Block Blob storage account. It requires sub-millisecond write latency and must tolerate the loss of a single datacenter facility within the primary region without any data loss or application downtime.
2. App2 stores client documents in a Standard General Purpose v2 (GPv2) storage account. It must remain online and survive the failure of an entire availability zone in the primary region with zero recovery time. Additionally, the application must support read-only access to a secondary region for reporting purposes during normal operations.

Which two redundancy configurations should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Zone-redundant storage (ZRS) for App1; Read-access geo-zone-redundant storage (RA-GZRS) for App2

Cevap

Zone-redundant storage (ZRS) for App1 and Read-access geo-zone-redundant storage (RA-GZRS) for App2
The correct configurations are Zone-redundant storage (ZRS) for App1 and Read-access geo-zone-redundant storage (RA-GZRS) for App2. App1 utilizes the Premium Block Blob tier, which supports only LRS and ZRS. To handle a physical datacenter failure in the primary region, ZRS is required. App2 requires high availability across zones in the primary region alongside read access to a secondary region, which requires RA-GZRS.

Adım Adım Çözüm

1
Analyze the App1 storage type and resiliency requirements.
App1 uses Premium Block Blob storage. Premium tier blob storage only supports Locally-redundant storage (LRS) and Zone-redundant storage (ZRS). To survive the loss of a single datacenter facility, Zone-redundant storage (ZRS) is required.
LRS does not survive a datacenter facility outage, and geo-redundancy options are not available in the Premium Block Blob tier.
2
Analyze the App2 storage type and resiliency requirements.
App2 uses Standard GPv2 storage, requires zonal resilience (survive a zone outage in the primary region), and must support read-only secondary access.
Read-access geo-zone-redundant storage (RA-GZRS) combines zonal redundancy in the primary region with geo-replication and read-only secondary endpoints. Read-access geo-redundant storage (RA-GRS) only uses LRS in the primary region, meaning it cannot survive a primary zone failure without manual/automatic failover (violating the zero recovery time requirement).

Anahtar Kavram

Selecting Azure Storage redundancy options based on performance tiers, zonal availability, and cross-region read access.
Soru 523Soru

A digital publishing company is designing a storage architecture for static web assets. The assets will be hosted in a General Purpose v2 (GPv2) storage account. The architecture must satisfy the following criteria:

* Data must survive a complete regional outage of the primary Azure region.
* During normal operations and during a regional outage, client applications must be able to read assets directly from the secondary region without any failover operations being triggered.

Which two storage redundancy configurations should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Read-access geo-redundant storage (RA-GRS); Read-access geo-zone-redundant storage (RA-GZRS)

Cevap

The correct configurations are Read-access geo-redundant storage (RA-GRS) and Read-access geo-zone-redundant storage (RA-GZRS).
Both Read-access geo-redundant storage (RA-GRS) and Read-access geo-zone-redundant storage (RA-GZRS) replicate data to a secondary region and expose a read-only endpoint in that secondary region, allowing immediate reads without any failover.

Adım Adım Çözüm

1
Analyze the requirement to survive a complete regional outage.
Replicating data to a secondary region requires a geo-redundant option (such as GRS, GZRS, RA-GRS, or RA-GZRS).
LRS and ZRS do not replicate data outside of the primary region.
2
Analyze the requirement to read from the secondary region without initiating failover.
This requires read access to the secondary endpoint, which is only provided by the read-access variants: RA-GRS and RA-GZRS.
Standard GRS and GZRS replicate data to the secondary region but do not allow read access to that data unless a failover is initiated.

Anahtar Kavram

Azure Storage redundancy options that provide geo-replication and read access to the secondary region endpoint without requiring failover.
Soru 524Soru

You are designing a backup solution for an Azure Virtual Machine that hosts a critical database. The virtual machine has the following characteristics and requirements:

* The virtual machine uses Premium SSD v2 managed disks.
* You must protect the database by taking backups every 44 hours.
* Backups must survive a zone-level outage in the primary region.
* Operational recoveries for any backup under 77 days old must use the instant recovery feature to minimize recovery time.
* Weekly backups must be retained for 55 years to meet regulatory compliance.

Which two actions should you include in the backup design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Recovery Services vault and configure its backup storage redundancy to use Zone-Redundant Storage (ZRS).; Configure an Enhanced backup policy with a schedule of every 44 hours and set the instant restore retention to 77 days.

Cevap

Create a Recovery Services vault and configure its backup storage redundancy to use Zone-Redundant Storage (ZRS), and configure an Enhanced backup policy with a schedule of every 44 hours and set the instant restore retention to 77 days.
To protect an Azure Virtual Machine using Premium SSD v2 disks with a 44-hour backup frequency and a 77-day instant recovery window, an Enhanced backup policy in a Recovery Services vault is required. To survive a zone-level outage, the vault's backup storage redundancy must be configured as Zone-Redundant Storage (ZRS).

Adım Adım Çözüm

1
Determine the vault type and storage redundancy configuration.
A Recovery Services vault with Zone-Redundant Storage (ZRS) is selected.
Azure VMs must be backed up using a Recovery Services vault, and ZRS is required to survive a zone-level outage in the primary region.
2
Analyze the virtual machine disk configuration and backup frequency requirements.
An Enhanced backup policy is required.
Standard backup policies do not support Premium SSD v2 managed disks, hourly backup frequencies, or instant restore retention greater than 55 days.
3
Define the policy schedule and instant recovery settings.
The Enhanced policy is configured with a 44-hour schedule and a 77-day instant restore retention window.
This directly meets the 44-hour RPO and the 77-day instant recovery operational requirement.

Anahtar Kavram

Azure VM Backup Enhanced Policy and Vault Redundancy
Soru 525Soru

A financial services company is designing a container-based credit scoring application on Azure. The application has the following design requirements:

* A real-time scoring API that must scale dynamically to zero during periods of inactivity and automatically scale up in response to HTTP request spikes, with minimal administrative and infrastructure management effort.
* A batch risk-processing engine that executes long-running, CPU-intensive simulation tasks that can take up to 4 hours to complete.

Which two container hosting solutions should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps for the real-time scoring API; Azure Container Apps Jobs for the batch risk-processing engine

Cevap

Azure Container Apps for the real-time scoring API and Azure Container Apps Jobs for the batch risk-processing engine.
Selecting Azure Container Apps for the real-time scoring API provides native scale-to-zero capabilities and automatic HTTP scaling without the administrative overhead of cluster management. Selecting Azure Container Apps Jobs for the batch risk-processing engine supports containerized tasks that run to completion and can execute for up to 24 hours, satisfying the 4-hour processing requirement.

Adım Adım Çözüm

1
Evaluate hosting options for the real-time scoring API requiring scale-to-zero capability and minimal administrative overhead.
Azure Container Apps natively scales to zero based on HTTP traffic and requires minimal management. In contrast, Azure Kubernetes Service (AKS) adds significant cluster management overhead, and Azure Container Instances (ACI) lacks native HTTP-based scale-to-zero autoscaling.
This matches the API requirements with the lower-overhead serverless container options.
2
Evaluate hosting options for the batch risk-processing engine running 4-hour simulation tasks.
Azure Container Apps Jobs is selected because it supports batch tasks running up to 24 hours. Azure Functions on a Consumption plan is ruled out because it has a 10-minute maximum execution timeout.
This ensures the long-running task does not time out during execution.

Anahtar Kavram

Choosing Azure container solutions based on operational overhead, scaling behavior, and execution limits.
Soru 526Soru

Your company has an Azure environment with a hub virtual network named `vnet-hub-core` (10.10.0.0/1610.10.0.0/16) and a spoke virtual network named `vnet-prod-spoke` (10.20.0.0/1610.20.0.0/16). The virtual networks are peered. A firewall is deployed in the hub virtual network with the private IP address 10.10.1.410.10.1.4. You are configuring a route table for the subnets in `vnet-prod-spoke` to ensure all internet-bound traffic is routed through the firewall in the hub. Which route should you add to the route table to meet this requirement without breaking local communication within the spoke virtual network?

Cevabı ve açıklamayı göster

Cevap: A route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4

Cevap

A route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4
The correct option is the route with address prefix 0.0.0.0/00.0.0.0/0, next hop type Virtual appliance, and next hop IP address 10.10.1.410.10.1.4. This configuration directs all traffic destined for the internet through the Azure Firewall in the hub virtual network. Because Azure uses Longest Prefix Match (LPM), the default local system route for the spoke (10.20.0.0/1610.20.0.0/16) will take precedence for internal traffic, leaving local subnet-to-subnet communication intact.

Adım Adım Çözüm

1
Identify the target destination for internet-bound traffic.
The target destination prefix for all internet-bound traffic is 0.0.0.0/00.0.0.0/0.
In IP routing, 0.0.0.0/00.0.0.0/0 represents the default route, which matches any destination address not covered by other routing entries.
2
Determine the next hop type and IP address of the firewall virtual appliance.
The next hop type is Virtual appliance, and the next hop IP address is 10.10.1.410.10.1.4.
Azure Firewall acts as a network virtual appliance, so traffic must be directed to its private IP address in the hub.
3
Verify that local communication within the spoke virtual network is preserved.
The route table will contain the custom default route (0.0.0.0/00.0.0.0/0), but the system route for 10.20.0.0/1610.20.0.0/16 remains active.
Azure uses Longest Prefix Match (LPM) routing. The local system route (10.20.0.0/1610.20.0.0/16) has a longer prefix than the custom default route (0.0.0.0/00.0.0.0/0), ensuring internal spoke traffic stays local.

Anahtar Kavram

Azure User-Defined Routes (UDR) and Longest Prefix Match (LPM) routing rules.
Soru 527Soru

A company is planning the deployment of two workloads to Azure Virtual Machines:
- Workload 1: A non-critical development testing application that runs intermittently, can tolerate interruptions, and requires the lowest possible compute cost.
- Workload 2: A production database that runs continuously in a steady state and requires high availability.

Which two of the following VM configuration strategies should you include in the design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Workload 1 on Azure Spot Virtual Machines.; Deploy Workload 2 on standard Azure Virtual Machines with Azure Reservations.

Cevap

Deploy Workload 1 on Azure Spot Virtual Machines and deploy Workload 2 on standard Azure Virtual Machines with Azure Reservations.
For the development workload that is non-critical and can be interrupted, Azure Spot Virtual Machines provide the lowest cost. For the steady-state production database, standard Virtual Machines combined with Azure Reservations offer cost efficiency without eviction risk.

Adım Adım Çözüm

1
Analyze Workload 1 requirements.
Workload 1 is a non-critical development workload that can be interrupted and requires minimal cost.
This matches the profile of Azure Spot Virtual Machines, which offer deep discounts in exchange for the possibility of eviction when capacity is needed.
2
Analyze Workload 2 requirements.
Workload 2 is a steady-state production database requiring high availability.
This requires standard VMs with reservations to reduce cost without risking eviction, and deploying across multiple availability zones for high availability.

Anahtar Kavram

Selecting the appropriate virtual machine pricing and availability options based on workload criticalness and usage patterns.
Tahmini Süre:1m 0s
Soru 528Soru

AeroTerra GeoServices is designing a business continuity solution for a seismic telemetry ingestion system. The system continuously writes incoming sensor data to an Azure Storage account.

The design must meet the following requirements:
- Recovery Point Objective (RPORPO): Less than 15 minutes.
- Recovery Time Objective (RTORTO): Less than 1 hour.
- Read Availability: The analytics application must have continuous read access to telemetry data, even during a primary region outage.
- Write Availability: Telemetry writes must be restored in a secondary region within the RTORTO.
- Cost: Minimize costs by avoiding multi-region active-active write configurations.

To achieve this, the architect proposes using a Read-Access Geo-Redundant Storage (RA-GRS) account and performing a customer-managed failover in the event of a primary region disaster.

Which two statements correctly describe the data access capabilities and failover behavior for this storage configuration? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Prior to initiating the failover, the secondary region endpoint is read-only, and any attempt to write data directly to the secondary region will fail.; Upon completion of the customer-managed failover, the storage account replication type is automatically converted to Locally Redundant Storage (LRS) in the new primary region.

Cevap

The secondary region endpoint remains read-only before the failover is initiated, and once the customer-managed failover completes, the storage account replication type is automatically converted to Locally Redundant Storage (LRS) in the new primary region.
Read-Access Geo-Redundant Storage (RA-GRS) provides read-only access to the secondary region during normal operations, so write operations directed to the secondary region prior to failover will fail. When a customer-managed failover is completed, the secondary region becomes the new primary region, and the replication configuration is automatically changed to Locally Redundant Storage (LRS).

Adım Adım Çözüm

1
Analyze the read and write capability requirements during normal operations and during a disaster.
The system requires read access from the secondary region prior to failover and writes to be restored in the secondary region after a disaster within the RTORTO.
This matches the behavior of Read-Access Geo-Redundant Storage (RA-GRS).
2
Evaluate the write capabilities of the secondary region prior to initiating a failover.
The secondary region is read-only, and direct writes are blocked.
RA-GRS only supports read access on the secondary endpoint during normal operations.
3
Determine the state of the storage account replication after the failover completes.
The storage account replication type is changed to Locally Redundant Storage (LRS).
Azure automatically converts geo-redundant storage to locally redundant storage in the new primary region when a customer-managed failover is executed.

Anahtar Kavram

Azure Storage replication failover behavior and write constraints of RA-GRS
Soru 529Soru

Your company has an Azure subscription containing multiple development environments. You need to delegate the management of virtual machines to a development operations team. The team must be able to perform all virtual machine operations except deleting virtual machines. The delegation must follow the principle of least privilege, apply only to the development subscription, and be assigned to a Microsoft Entra ID security group. You decide to create a custom RBAC role to meet these requirements.

In which order should you perform the steps to configure and apply the custom role?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

Export the template, modify the JSON file to set actions and assignable scopes, register the custom role in the tenant, and then assign the role to the Entra ID security group at the subscription scope.
To create and apply a custom Azure RBAC role, you must follow a structured lifecycle. First, retrieve a JSON template using an existing role. Second, customize the `Actions`, `NotActions`, and `AssignableScopes` fields inside the JSON to align with least privilege and target scope. Third, register the custom role within the Microsoft Entra tenant using the command `New-AzRoleDefinition`. Finally, assign the registered role to the Microsoft Entra ID security group at the desired subscription scope.

Adım Adım Çözüm

1
Run the `Get-AzRoleDefinition` command with the name of a built-in role (e.g., Virtual Machine Contributor) and export the output to a JSON file.
A local JSON file containing the schema of the role definition is created.
Creating a custom role from scratch is error-prone; exporting an existing role definition provides a correctly formatted JSON schema.
2
Open the JSON file and configure `Actions` to include `Microsoft.Compute/virtualMachines/*`, set `NotActions` to include `Microsoft.Compute/virtualMachines/delete`, and configure `AssignableScopes` to target the subscription ID.
The JSON file is populated with correct permissions and scope limitations.
Setting `Actions` and `NotActions` meets the access requirements, and defining the subscription scope prevents the custom role from being assigned at unauthorized scopes.
3
Execute the `New-AzRoleDefinition` command, passing the path to the modified JSON file.
The custom role is registered and becomes available for assignment in the Azure tenant.
Before a custom role can be assigned to security principals, it must be officially registered in the tenant.
4
Assign the custom role to the Microsoft Entra ID security group at the subscription scope using the Azure Portal, CLI, or PowerShell.
Members of the security group receive the specified permissions on the target subscription.
The final step is to assign the registered custom role to the security group to grant active permissions.

Anahtar Kavram

Azure Custom Role Lifecycle and Assignment
Soru 530Soru

An online gaming platform is designing a privileged access and governance strategy for its Azure infrastructure. The platform has the following requirements:

* Operations engineers must have administrative access to production database resources only when performing scheduled maintenance tasks.
* Two dedicated emergency access (break-glass) accounts must be able to access the environment even during a multi-factor authentication (MFA) service outage.

Which of the following configurations should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Add the operations engineers to a Microsoft Entra ID group and configure the group with an eligible role assignment in Privileged Identity Management (PIM). Exclude the emergency access accounts from the Conditional Access policy that enforces MFA.

Cevap

Add the operations engineers to a Microsoft Entra ID group and configure the group with an eligible role assignment in Privileged Identity Management (PIM), while excluding the emergency access accounts from the Conditional Access policy that enforces MFA.
The correct recommendation uses a Microsoft Entra ID security group to simplify role administration and makes the group eligible for the role in Privileged Identity Management (PIM) to support just-in-time access. In addition, it explicitly excludes the emergency access accounts from MFA enforcement in Conditional Access to ensure the tenant remains accessible during an MFA service outage.

Adım Adım Çözüm

1
Evaluate access requirements for operations engineers
Identify that operations engineers need temporary, just-in-time access, which requires an eligible role assignment in Privileged Identity Management (PIM).
This minimizes standing administrative privileges in accordance with the principle of least privilege.
2
Apply scalable administration guidelines
Assign the role to a Microsoft Entra ID security group rather than directly to individual users.
This avoids administrative overhead and keeps access control scalable.
3
Design emergency access resilience
Exclude emergency access (break-glass) accounts from the Conditional Access policies that enforce MFA.
This prevents administrative lockout in the event of an MFA service outage.

Anahtar Kavram

Privileged Identity Management (PIM) group-based eligibility and emergency account management in Entra ID Governance
Soru 531Soru

A logistics provider is designing a telemetry analysis platform on Azure. The solution must meet the following requirements:
- Maintain regional disaster resilience for all ingested telemetry data.
- Allow data scientists to perform ad-hoc, exploratory queries on raw CSV telemetry log files without incurring ongoing costs for idle compute resources.

Which two design choices should you include in the storage and analytics architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the telemetry storage account as Geo-Redundant Storage (GRS).; Use Azure Synapse Analytics serverless SQL pools to query the CSV files.

Cevap

Configuring the storage account as Geo-Redundant Storage (GRS) and using Azure Synapse Analytics serverless SQL pools to query the CSV files.
Configuring the storage account as Geo-Redundant Storage (GRS) satisfies the requirement for regional disaster resilience by replicating data across regions. Using Azure Synapse Analytics serverless SQL pools meets the requirement for ad-hoc, exploratory queries on CSV files without ongoing costs because it uses a pay-per-query model and does not require provisioned compute infrastructure.

Adım Adım Çözüm

1
Evaluate the storage redundancy options for regional resilience.
Geo-Redundant Storage (GRS) is selected.
Locally Redundant Storage (LRS) does not protect against a regional outage, whereas GRS replicates data to a secondary region.
2
Evaluate the query options for ad-hoc exploratory queries on CSV files.
Azure Synapse Analytics serverless SQL pools are selected.
Serverless SQL pools query files in-place and charge only per query, avoiding the costs of idle provisioned dedicated SQL pools.

Anahtar Kavram

Selecting cost-effective analytical query capabilities and disaster-resilient storage tiers in Azure Synapse and Azure Data Lake Storage.
Soru 532Soru

A logistics enterprise is designing a containerized system to process real-time shipping telemetry data. The system must meet the following requirements:

* Host containerized microservices that process messages from an Azure Service Bus queue.
* Scale compute instances dynamically down to zero when no messages are in the queue.
* Support long-running background tasks that run continuously for up to 20 minutes to aggregate data.
* Minimize administrative and operational overhead, as the development team has no experience managing container orchestrators.
* Ensure high availability for steady-state production workloads without the risk of infrastructure eviction.

Which Azure compute service should you recommend to host this containerized system?

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps

Cevap

Azure Container Apps
Azure Container Apps is a serverless container platform that allows hosting microservices and background tasks without the operational burden of managing Kubernetes infrastructure. It natively supports scaling to zero based on event queues (using KEDA) and allows background workloads to execute beyond 10 minutes, making it the ideal solution for this scenario.

Adım Adım Çözüm

1
Evaluate the management and operational overhead constraints.
The requirement to minimize administrative overhead and the team's lack of container orchestration experience rules out solutions like Azure Kubernetes Service (AKS) which require manual cluster and infrastructure management.
Managed serverless offerings are preferred when team expertise in Kubernetes is low and operational overhead must be minimized.
2
Assess scaling and execution duration limits.
The workload must scale to zero when idle but requires up to 20 minutes of continuous execution for background aggregation.
This rules out Azure Functions on a Consumption plan because it enforces a hard 10-minute execution timeout limit.
3
Verify eviction and availability requirements.
Steady-state production workloads requiring high availability cannot use Spot instances.
This rules out Azure Spot Virtual Machine Scale Sets due to their interruptible nature and potential for sudden eviction.

Anahtar Kavram

Selecting Azure container compute services based on operational overhead, scaling, and execution duration requirements.
Tahmini Süre:1m 30s
Soru 533Soru

You are designing a serverless background processing solution in Azure. The solution must run a data import job once daily. The job takes approximately 25 minutes to complete. You need to select an Azure Functions hosting option that supports this execution duration while minimizing cost and management overhead. Which hosting plan should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure Functions Premium plan

Cevap

Azure Functions Premium plan
The Azure Functions Premium plan is the correct choice because it supports a default execution duration of 30 minutes (which can be customized to be unlimited), satisfying the 25-minute requirement. It also offers dynamic scaling and avoids the administrative overhead of managing full virtual machines or Kubernetes clusters.

Adım Adım Çözüm

1
Analyze the execution duration requirement of the background job.
The job requires 25 minutes of continuous execution.
This establishes the minimum execution timeout requirement for the hosting service.
2
Evaluate the execution limits of serverless compute options in Azure.
The Consumption plan limits execution to a maximum of 10 minutes, whereas the Premium plan allows 30 minutes by default and can be configured to run indefinitely.
Choosing the Consumption plan would lead to job failures due to timeouts, so the Premium plan is required for serverless execution.
3
Assess administrative overhead and cost-efficiency requirements.
Kubernetes and dedicated virtual machines introduce high setup and maintenance costs, whereas Azure Functions Premium scales down when idle.
The Premium plan minimizes operational overhead and optimizes costs compared to running dedicated infrastructure.

Anahtar Kavram

Selecting appropriate Azure serverless compute options based on execution timeout and scaling requirements.
Soru 534Soru

An enterprise is designing a hub-and-spoke virtual network topology in Azure with the following resource allocations:

* Hub VNet (`vnet-hub-prod`): CIDR 10.200.0.0/1610.200.0.0/16 containing a Network Virtual Appliance (NVA) at IP address 10.200.1.1010.200.1.10.
* Spoke VNet A (`vnet-spoke-web`): CIDR 10.201.0.0/1610.201.0.0/16.
* Spoke VNet B (`vnet-spoke-data`): CIDR 10.202.0.0/1610.202.0.0/16.

Virtual network peering is configured between `vnet-hub-prod` and `vnet-spoke-web`, and between `vnet-hub-prod` and `vnet-spoke-data`. No direct peering exists between the two spokes.

You are designing the routing tables for `vnet-spoke-web` to satisfy these requirements:
1. All outbound traffic destined for the database servers in `vnet-spoke-data` must transit through the NVA.
2. All outbound traffic destined for the management services in the hub VNet (`vnet-hub-prod`) must transit through the NVA.
3. Subnet-to-subnet traffic within `vnet-spoke-web` must remain direct and must not be sent to the NVA.

Which two routing configurations should you implement in the route table associated with the subnets in `vnet-spoke-web`?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A route for 10.200.0.0/1610.200.0.0/16 with the next hop set to Virtual Appliance and the IP address 10.200.1.1010.200.1.10; A route for 10.202.0.0/1610.202.0.0/16 with the next hop set to Virtual Appliance and the IP address 10.200.1.1010.200.1.10

Cevap

Configure two routes in the route table for the web spoke subnets: one route for the hub range of 10.200.0.0/1610.200.0.0/16 pointing to the Network Virtual Appliance (NVA) at 10.200.1.1010.200.1.10, and another route for the database spoke range of 10.202.0.0/1610.202.0.0/16 pointing to the same NVA IP address.
To route traffic from the web spoke to the hub VNet through the NVA, a route matching the exact prefix of the hub (10.200.0.0/1610.200.0.0/16) must be defined. This overrides the system-defined VNet peering route. To route traffic to the database spoke, a route for 10.202.0.0/1610.202.0.0/16 must also be defined pointing to the NVA, as there is no default system route for non-peered spokes. Leaving the local web spoke range (10.201.0.0/1610.201.0.0/16) out of the custom route table ensures that local traffic utilizes the default system route and remains direct.

Adım Adım Çözüm

1
Analyze default system routes in the web spoke virtual network.
The web spoke contains a local system route for 10.201.0.0/1610.201.0.0/16 (Virtual Network next hop) and a peering system route for 10.200.0.0/1610.200.0.0/16 (VNet Peering next hop). No route exists for the database spoke (10.202.0.0/1610.202.0.0/16).
Understanding the baseline system routes is critical to determining which traffic flows need to be explicitly overridden or added using User Defined Routes (UDRs).
2
Design the route to override the default hub peering path through the NVA.
Create a UDR for 10.200.0.0/1610.200.0.0/16 pointing to the NVA IP address (10.200.1.1010.200.1.10).
UDRs override system routes of the same prefix length. This successfully redirects hub-bound traffic through the NVA.
3
Design the route to reach the database spoke via the NVA.
Create a UDR for 10.202.0.0/1610.202.0.0/16 pointing to the NVA IP address (10.200.1.1010.200.1.10).
Because the spoke VNets are not directly peered, a route must be added to direct database-bound traffic to the NVA for transit routing.
4
Verify that local traffic remains unaffected.
No UDR is added for the 10.201.0.0/1610.201.0.0/16 prefix, meaning the default local system route handles intra-VNet communication.
This satisfies the requirement that subnet-to-subnet traffic within the web spoke must remain direct and not transit the NVA.

Anahtar Kavram

Azure Longest Prefix Match (LPM) and Route Precedence
Soru 535Soru

An enterprise is designing a disaster recovery (DR) solution from the East US region to the West US region for an e-commerce application. The application consists of the following three tiers:

* Web Tier: Two virtual machines (VMs) with a write churn of 2 MB/s2\text{ MB/s} per VM.
* Application Tier: Two VMs with a write churn of 5 MB/s5\text{ MB/s} per VM.
* Database Tier: One SQL Server VM (`db-prod-01`) with three Premium SSD disks:
* OS disk: 1 MB/s1\text{ MB/s} write churn.
* Data disk: 6 MB/s6\text{ MB/s} write churn.
* Transaction log disk: 22 MB/s22\text{ MB/s} write churn.

The business requires a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour.

Which disaster recovery design should you recommend to meet the requirements?

Cevabı ve açıklamayı göster

Cevap: Replicate the web and application tier VMs using Azure Site Recovery. Configure SQL Server Always On Availability Groups to replicate the database tier to a target VM in the West US region.

Cevap

Replicate the web and application tier VMs using Azure Site Recovery. Configure SQL Server Always On Availability Groups to replicate the database tier to a target VM in the West US region.
The correct design uses Azure Site Recovery for the web and application tier VMs because their write churn rates (2 MB/s2\text{ MB/s} and 5 MB/s5\text{ MB/s} respectively) are well within the capabilities of Azure Site Recovery. For the database tier, the transaction log disk has a write churn rate of 22 MB/s22\text{ MB/s}, which exceeds both the standard replication limit (10 MB/s10\text{ MB/s}) and the high-churn replication limit (20 MB/s20\text{ MB/s}) per disk in Azure Site Recovery. Therefore, database-native replication using SQL Server Always On Availability Groups must be recommended to handle the high churn rate while achieving the target RPO and RTO.

Adım Adım Çözüm

1
Analyze the write churn metrics for all disks in the application tiers.
Web tier VMs (2 MB/s2\text{ MB/s}) and application tier VMs (5 MB/s5\text{ MB/s}) are within standard limits. The database VM has a transaction log disk with 22 MB/s22\text{ MB/s} write churn.
To determine which Azure Site Recovery limits might be exceeded by the workload.
2
Compare the database transaction log disk churn (22 MB/s22\text{ MB/s}) against Azure Site Recovery limits.
The churn rate exceeds both the standard (10 MB/s10\text{ MB/s}) and high-churn (20 MB/s20\text{ MB/s}) replication limits per disk for Azure Site Recovery.
To evaluate if Azure Site Recovery can replicate the database virtual machine.
3
Select the appropriate replication mechanism for the database tier and the other tiers.
Recommend Azure Site Recovery for the web and application tiers, and SQL Server Always On Availability Groups (database-native replication) for the database tier.
To ensure that all workloads are replicated successfully within their technical limits and meet the 15-minute RPO and 1-hour RTO.

Anahtar Kavram

Azure Site Recovery disk write churn limitations and database-native replication alternatives.
Soru 536Soru

An insurance firm is designing a container-based application that processes claims from an Azure Service Bus queue. The design must satisfy the following requirements:

* Scale dynamically from zero to hundreds of instances using Kubernetes Event-driven Autoscaling (KEDA) based on the queue depth.
* Establish private connectivity to secure back-end databases within an Azure Virtual Network.
* Minimize the administrative effort required to manage the container orchestration platform.
* Support execution times of up to 15 minutes per message without timeout.

Which two components should you include in the design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps to host the containerized workloads; Azure Container Apps scale rules configured for Azure Service Bus queue length

Cevap

Azure Container Apps to host the containerized workloads, and Azure Container Apps scale rules configured for Azure Service Bus queue length.
The design requirement is best met by combining Azure Container Apps (ACA) to host the containers and configuring scale rules based on the Service Bus queue length. ACA is a serverless environment that natively supports KEDA-driven scaling down to zero and up to hundreds of instances. It also supports deployment into custom virtual networks for private database access, allows executions to exceed 10 minutes, and significantly reduces administrative overhead compared to managing an AKS cluster.

Adım Adım Çözüm

1
Evaluate the administrative effort and container hosting options.
Azure Container Apps (ACA) is selected over Azure Kubernetes Service (AKS) because ACA is a fully managed serverless platform that eliminates cluster management overhead.
The requirement specifically demands minimizing administrative effort.
2
Assess scaling mechanisms and execution limits.
Native KEDA scaling rules in ACA are chosen, and Azure Functions on a Consumption plan is eliminated due to its 10-minute timeout constraint.
The processing task can take up to 15 minutes, which exceeds the Consumption plan's timeout.
3
Verify virtual network integration and private connectivity.
Azure Container Apps supports deployment within a custom Azure Virtual Network (VNet) to secure database connections privately.
This satisfies the requirement to establish private connectivity to secure back-end databases.

Anahtar Kavram

Selecting serverless container hosting (Azure Container Apps) to minimize operational overhead while utilizing native KEDA integrations for queue-based scaling and avoiding platform-specific execution timeouts.
Soru 537Soru

ZenithFlow Logistics is designing a storage solution for a critical delivery tracking application that stores unstructured telemetry logs and delivery receipts in Azure Blob Storage. The solution must meet the following requirements:

- Under normal operations, data must be replicated across 33 availability zones within the primary region to protect against a single datacenter outage.
- In the event of a complete primary region outage, read access to the tracking logs must remain available immediately with a Recovery Time Objective (RTO) of 00.
- Write operations must be restored to a secondary region with a Recovery Point Objective (RPO) of less than 1515 minutes and an RTO of less than 11 hour.
- Cost and operational complexity must be minimized.

Which two actions should you include in the design to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the storage account to use Read-Access Geo-Zone-Redundant Storage (RA-GZRS).; Initiate a customer-managed failover of the storage account to the secondary region to restore write capabilities.

Cevap

Configure the storage account to use Read-Access Geo-Zone-Redundant Storage (RA-GZRS), and initiate a customer-managed failover of the storage account to the secondary region to restore write capabilities.
To meet all constraints, the design must use Read-Access Geo-Zone-Redundant Storage (RA-GZRS) and utilize customer-managed failover. RA-GZRS replicates data across three availability zones in the primary region, meeting the zone-redundancy requirement under normal operations. It also provides a read-only secondary endpoint, enabling immediate read access (RTO of 00) during a primary region outage. To restore write capabilities in the secondary region within the target RTO, a customer-managed failover must be initiated, converting the secondary region to the new primary region.

Adım Adım Çözüm

1
Evaluate the primary region redundancy requirements.
Since the data must be replicated across 33 availability zones in the primary region, a zone-redundant storage option is required. This eliminates RA-GRS, which only replicates locally (LRS) in the primary region, and leaves RA-GZRS as the correct replication option.
RA-GZRS combines the zone-redundancy of ZRS in the primary region with geo-replication to a secondary region.
2
Evaluate the read availability requirement during a primary region outage.
To achieve an RTO of 00 for reads, the application must be able to read from the secondary region immediately without waiting for a failover. This requires Read-Access enablement, which exposes the secondary read-only endpoint.
RA-GZRS provides a secondary endpoint that remains readable even when the primary region is completely offline.
3
Evaluate the write recovery requirement.
Since the secondary endpoint is read-only, write operations cannot be performed against the secondary region directly. A failover must be initiated to convert the secondary region into the new primary region, restoring write access.
Customer-managed failover is the standard, supported method to recover write capabilities for GRS/GZRS storage accounts during a regional outage.

Anahtar Kavram

Azure Storage replication redundancy options (RA-GZRS vs. RA-GRS) and the mechanics of customer-managed failover for disaster recovery.
Soru 538Soru

An enterprise is designing a multi-region container-based solution on Azure. The solution requires hosting two distinct workloads:

- Workload 1: A backend service that must scale from zero dynamically based on the volume of messages in an Azure Service Bus queue. The enterprise wants to minimize ongoing administrative overhead and avoid managing container orchestration infrastructure.
- Workload 2: A security monitoring tool that requires direct access to the underlying Kubernetes API, custom daemonsets for host-level network packet inspection, and custom kernel parameter modifications.

Additionally, regulatory compliance policies mandate that log data must be isolated regionally and cannot leave the respective geographic boundaries of each deployment region.

Which two configurations should you include in the design to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Workload 1 to Azure Container Apps (ACA).; Deploy Workload 2 to Azure Kubernetes Service (AKS).

Cevap

Deploy Workload 1 to Azure Container Apps (ACA) and deploy Workload 2 to Azure Kubernetes Service (AKS).
Deploying the event-driven scaling workload to Azure Container Apps meets the requirement for automatic KEDA-based scaling to zero while minimizing operational overhead. Deploying the security component to Azure Kubernetes Service is necessary because it requires host-level daemonsets, custom kernel parameters, and direct Kubernetes API access, which are not supported in serverless container environments.

Adım Adım Çözüm

1
Analyze Workload 1 requirements.
Workload 1 needs event-driven queue scaling to zero and minimum management. Azure Container Apps natively integrates KEDA and abstracts host management, satisfying this requirement.
Matching the serverless scale-to-zero queue requirements with the lowest overhead service.
2
Analyze Workload 2 requirements.
Workload 2 requires deep host integration, custom daemonsets, and Kubernetes API access. This requires Azure Kubernetes Service (AKS), as these features are locked down in serverless container solutions.
Differentiating container runtimes based on administrative control and platform restrictions.
3
Evaluate the logging requirements against regulatory boundaries.
Separate Log Analytics workspaces must be deployed in each region to comply with data sovereignty regulations, ruling out a single centralized workspace.
Ensuring compliance with local geographic data boundaries.

Anahtar Kavram

Selecting the appropriate Azure container service based on orchestration complexity, Kubernetes API access, node-level control, and regional logging compliance requirements.
Soru 539Soru

A logistics company is designing a telemetry ingestion backend for 100,000100,000 active delivery vehicles. Each vehicle uploads coordinate and sensor data every 1010 seconds. The storage solution must be designed to meet the following requirements:
- Regional disaster resilience must be guaranteed with a recovery point objective (RPORPO) of zero.
- Write-path hot partitioning must be prevented under high-throughput ingestion.
- Security credentials for read access must be easily revocable.

Which configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Configure an Azure Cosmos DB account with a single write region and a secondary replica region using Strong consistency, partition the container using VehicleID, and utilize a token broker to issue short-lived Cosmos DB resource tokens for client access.

Cevap

Configure an Azure Cosmos DB account with a single write region and a secondary replica region using Strong consistency, partition the container using VehicleID, and utilize a token broker to issue short-lived Cosmos DB resource tokens for client access.
The configuration utilizing a single write region with a secondary replica under Strong consistency satisfies the RPO = 0 requirement by executing synchronous replication. Using the high-cardinality VehicleID as the partition key ensures that writes are evenly distributed, avoiding hot partitions. Generating short-lived resource tokens via a token broker ensures that read access can be easily managed and revoked.

Adım Adım Çözüm

1
Select the database service and replication configuration to meet the disaster recovery constraint.
Azure Cosmos DB configured with a single write region and a secondary replica using Strong consistency.
Strong consistency guarantees that write operations are committed synchronously to the secondary replica before completing, ensuring a recovery point objective (RPO) of zero.
2
Select a partition key that distributes the write workload evenly.
Partition key: VehicleID.
With 100,000100,000 active vehicles, VehicleID has high cardinality. This distributes the ingestion throughput across many logical partitions, preventing write-path hot partitions.
3
Determine the access control mechanism for client applications.
Utilize a token broker to issue short-lived Cosmos DB resource tokens.
Resource tokens allow fine-grained access control to specific Cosmos DB resources and expire quickly, making them easily revocable and secure.

Anahtar Kavram

Designing partition keys and consistency configurations in Azure Cosmos DB to meet scalability, disaster recovery, and security requirements.
Soru 540Soru

An enterprise plans to migrate a mission-critical, stateful database application to Azure. The application has the following requirements:
- Strict regulatory compliance mandates physical isolation at the hardware level, ensuring no other customer workloads run on the same physical host.
- The database is highly memory-intensive, requiring a memory-to-vCPU ratio of at least 8:1.
- The transaction log storage requires at least 80,000 IOPS with consistent sub-millisecond latency.
- The compute infrastructure must achieve a 99.99% availability service level agreement (SLA).
- The solution must support Azure Hybrid Benefit to minimize licensing costs.

Which compute and storage architecture should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy Azure Dedicated Hosts using the Ebsv5-series host group across two Availability Zones, deploy the database Virtual Machines on these hosts, and configure Premium SSD v2 storage for the transaction logs.

Cevap

Deploy Azure Dedicated Hosts using the Ebsv5-series host group across two Availability Zones, deploy the database Virtual Machines on these hosts, and configure Premium SSD v2 storage for the transaction logs.
Deploying Azure Dedicated Hosts using the Ebsv5-series host group provides physical isolation at the hardware level, satisfying regulatory compliance. The Ebsv5-series is memory-optimized, meeting the required memory-to-vCPU ratio. To achieve the 99.99% availability SLA, the Dedicated Hosts must be deployed across at least two Availability Zones in the same region. Finally, Premium SSD v2 storage supports the required 80,000 IOPS with sub-millisecond latency, and Dedicated Hosts support host-level Azure Hybrid Benefit for license cost optimization.

Adım Adım Çözüm

1
Evaluate the requirement for hardware-level isolation and Azure Hybrid Benefit.
Determine that Azure Dedicated Hosts are necessary.
Standard multi-tenant VMs do not guarantee hardware isolation, whereas Dedicated Hosts provide physical servers dedicated to a single subscription and support licensing at the host level.
2
Select the appropriate compute series and storage configuration for high performance.
Select Ebsv5-series VMs and Premium SSD v2 storage.
The database needs an 8:1 memory-to-vCPU ratio (satisfied by the memory-optimized E-series) and a storage solution supporting 80,000 IOPS with sub-millisecond latency (satisfied by Premium SSD v2).
3
Configure the deployment architecture to meet the target availability SLA.
Distribute the Dedicated Hosts across at least two Availability Zones.
To achieve a 99.99% VM availability SLA when using Azure Dedicated Hosts, the hosts must be deployed in different Availability Zones within the same region.

Anahtar Kavram

Designing high-availability compute virtualization solutions on isolated hardware with specific performance constraints.
ÖncekiSayfa 27 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Solutions Architect (AZ-305) | Examkin