Tüm alıştırma soruları

A company has a regional TCP-based application deployed on Azure Virtual Machines in a single region. The virtual machines use Standard SKU public IP addresses. The solution must distribute TCP traffic at the transport layer and support the existing Standard SKU resources without configuration validation errors. Which load balancing service should you recommend?

An enterprise is designing a multi-region disaster recovery and business continuity solution for a web application deployed in the East US and West US regions. The application requirements include:

1. Global HTTPS traffic must be routed to the closest region with sub-minute failover detection, SSL/TLS termination, and path-based routing (e.g., routing `/api/*` requests to a specialized service).
2. The back-end relational database must support automatic failover to the secondary region without requiring connection string modifications in the application code.
3. Storage data must be replicated to the secondary region, but write operations are strictly restricted to the primary region until a failover occurs.

Which combination of Azure services and configurations should you recommend?

A financial services firm is planning to migrate a core risk-modeling simulation workload to Azure. The application has the following requirements:
- Complete physical isolation at the hardware level for the underlying physical servers to meet strict compliance mandates.
- In-memory data protection during processing using hardware-based enclaves that support Intel Software Guard Extensions (SGX).
- An overall availability service level agreement (SLA) of 99.99% for the virtual machines.
- The workload runs continuously and cannot tolerate unexpected evictions or interruptions.

Which two of the following configurations should you include in the infrastructure design to meet the requirements? (Select TWO).

An organization is designing the hosting architecture for a new multi-tenant financial application. The solution consists of the following components:

* A Web API that processes incoming payment verification requests. The API must scale down to zero instances during idle periods to minimize costs, must scale out within seconds to handle unpredictable spikes of up to $5,000$ concurrent requests, and must connect to a database hosted within a secured Azure Virtual Network (VNet).
* A daily ledger reconciliation process that aggregates data from external feeds and updates the database. The reconciliation process takes approximately 45 minutes to execute and must run inside the same VNet.

You need to select the most cost-effective Azure compute hosting options that satisfy these requirements.

Which hosting combination should you recommend?

You are designing a regional TCP-based application infrastructure. You deploy a Standard Azure Load Balancer to distribute inbound traffic across a backend pool of Azure Virtual Machines in a single virtual network. However, when you attempt to add the virtual machines to the backend pool, the configuration fails validation. Which of the following is the most likely cause of this validation failure?

A university library is designing an automated document archiving system to merge and compress digitized historical manuscripts into PDF/A format.

The system must meet the following requirements:
* Each document merging task is triggered by a message in an Azure Service Bus queue.
* A single archiving task takes between $12$ and $18$ minutes to complete.
* The archiving engine is packaged as a custom Linux-based container image that requires specialized PDF rendering libraries.
* The system must incur zero compute costs when there are no archiving tasks in the queue.
* Infrastructure management and operational overhead must be minimized.

Which Azure compute solution should you recommend?

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-weur` ($10.200.0.0/16$), contains a Virtual Network Gateway connected to an on-premises network. A spoke virtual network, `vnet-spoke-prod` ($10.201.0.0/16$), contains a workload subnet named `snet-app` ($10.201.1.0/24$). A pair of network virtual appliances (NVAs) is deployed in the hub and sits behind an internal load balancer at $10.200.4.100$.

The Virtual Network Gateway receives BGP route advertisements from on-premises, including a summary route of $172.16.0.0/12$ and a specific database subnet prefix of $172.16.50.0/24$. To inspect all on-premises bound traffic, you associate a route table named `rt-spoke-app` with the `snet-app` subnet and add a user-defined route (UDR) for $172.16.0.0/12$ pointing to the load balancer at $10.200.4.100$. Gateway route propagation is enabled on `rt-spoke-app`.

During testing, you observe that traffic from `snet-app` to the database tier ($172.16.50.10$) bypasses the NVAs and goes directly to the Virtual Network Gateway. Which action should you recommend to ensure all on-premises bound traffic is inspected by the NVAs?

A meteorological modeling company is designing the Azure compute virtualization infrastructure for two distinct workloads:

* Workload 1: A weather simulation model that runs daily. The model requires Message Passing Interface (MPI) support with sub-millisecond node-to-node latency, high CPU performance, and cannot tolerate interruptions during its four-hour execution window.
* Workload 2: A public-facing web API providing real-time weather alerts that requires a minimum availability SLA of 99.99% and must scale automatically to handle sudden traffic spikes.

Which two virtual machine configurations should you recommend to meet the requirements? (Select two.)

An enterprise is designing the network routing topology for an Azure environment. The topology includes the following components:
- A hub virtual network named `vnet-hub-cus` ($10.100.0.0/16$) containing an Azure Firewall with the private IP address $10.100.2.4$ and an ExpressRoute virtual network gateway.
- A production spoke virtual network named `vnet-prod-spoke` ($10.110.0.0/16$) with a subnet named `snet-prod-app` ($10.110.1.0/24$).
- A shared services spoke virtual network named `vnet-shared-spoke` ($10.120.0.0/16$) with a subnet named `snet-shared-db` ($10.120.1.0/24$).

The virtual networks `vnet-prod-spoke` and `vnet-shared-spoke` are peered directly with `vnet-hub-cus` but are not peered with each other.

The design must meet the following requirements:
- All traffic between `snet-prod-app` and `snet-shared-db` must be routed through the Azure Firewall for inspection.
- Virtual machines in `snet-prod-app` must be able to communicate with the on-premises network ($172.16.0.0/12$) via the ExpressRoute gateway.
- Traffic between virtual machines within the same subnet (`snet-prod-app`) must remain local and bypass the Azure Firewall.

Which TWO configurations should you implement to meet these requirements?

An organization is planning to migrate their on-premises VMware vSphere virtual machines (VMs) to Azure using Azure Migrate. Before scheduling the migration, they want to analyze the network connections and dependencies between their servers to ensure no critical connections are broken. Which two methods can they use to perform dependency analysis in Azure Migrate? (Choose two.)

An organization is designing a disaster recovery (DR) solution from the North Europe region to the West Europe region for an application hosted on an Azure Virtual Machine (VM1). The business requirements specify a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. VM1 runs a high-throughput PostgreSQL database and has the following disk configuration:

- OS Disk: 128 GB Premium SSD with a peak write churn of 2 MB/s
- Data Disk: 1 TB Premium SSD with a peak write churn of 28 MB/s
- Log Disk: 256 GB Premium SSD with a peak write churn of 32 MB/s

The total peak write churn for VM1 is 62 MB/s. Which disaster recovery design should you recommend to meet the requirements?

A health-tech company is designing a disaster recovery and traffic routing solution for a global patient portal hosted in both the East US 2 and UK South regions. The design must meet the following requirements:
- Terminate SSL sessions at the global entry point.
- Inspect traffic using a Web Application Firewall (WAF).
- Route requests dynamically based on the URL path, directing `/clinical/*` to one set of backend services and `/billing/*` to another.
- Ensure failover to the secondary region occurs in under 30 seconds during an outage, without relying on client-side DNS caching updates.

Which Azure service or feature should you recommend to manage the ingress traffic routing?

An enterprise is designing the network security for a two-tier application in Azure. The design includes:

* A virtual network named VNet1 containing two subnets: WebSubnet and DataSubnet.
* WebSubnet hosts web server virtual machines (VMs) that do not have public IP addresses.
* DataSubnet hosts a Private Endpoint for an Azure SQL Database named sql-db1.
* WebSubnet is associated with a Network Security Group (NSG) named NSG-Web.
* DataSubnet is associated with an NSG named NSG-Data.

The design must meet the following requirements:
* The web servers must connect to sql-db1 securely over its private IP address.
* All outbound traffic from WebSubnet to the internet must be blocked.
* Outbound traffic from WebSubnet must be restricted so that the web servers can only communicate with the Private Endpoint of sql-db1 and no other resources in VNet1.
* The design must minimize administrative effort by avoiding the use of individual, hardcoded IP addresses in NSG rules.

Which two configurations should you include in the design? (Choose two.)

An enterprise is designing a hub-and-spoke network topology in Azure to host a secure multi-tier application. The architecture consists of:

* A hub virtual network named `vnet-hub-core` ($10.100.0.0/16$) that hosts a central firewall Network Virtual Appliance (NVA) at IP address $10.100.2.4$.
* A spoke virtual network named `vnet-prod-spoke` ($10.150.0.0/16$) that contains two subnets: `snet-web` ($10.150.1.0/24$) and `snet-db` ($10.150.2.0/24$).
* Virtual network peering established between `vnet-hub-core` and `vnet-prod-spoke` with gateway transit and remote gateway options enabled.

A route table named `rt-web-tier` is associated with `snet-web` and contains a user-defined route (UDR) for $10.150.2.0/24$ with a next hop pointing to the NVA ($10.100.2.4$) to inspect all database-bound traffic. However, when web servers in `snet-web` attempt to establish database connections to VMs in `snet-db`, the connections time out. The database servers are verified as active, and Network Security Groups (NSGs) allow the traffic.

Which of the following routing configurations is the most appropriate solution to resolve the connectivity issue?

Your company is assessing the migration of an on-premises Microsoft SQL Server database to Azure. The database relies on cross-database queries and SQL Server Agent jobs to perform nightly transactional processing. Which Azure SQL deployment option should you select to support these features with minimal modification to the database or application code?

An enterprise is designing a hub-and-spoke virtual network topology in Azure to support a multi-tier application. The topology consists of the following components:
- A hub virtual network named `vnet-hub-eus` ($10.100.0.0/16$) that contains an Azure Firewall at IP address `10.100.1.4` and a Virtual Network Gateway connected to an on-premises environment via ExpressRoute.
- A spoke virtual network named `vnet-prod-spoke` ($10.101.0.0/16$) containing a subnet named `snet-web` ($10.101.1.0/24$).
- A virtual network peering connection between `vnet-hub-eus` and `vnet-prod-spoke` with gateway transit configured to allow the spoke to use the hub's gateway.

The on-premises network advertises specific subnets including `192.168.10.0/24` and `192.168.20.0/24` via BGP. You associate a new route table named `rt-prod-web` with the `snet-web` subnet.

You need to design a routing solution that meets the following requirements:
- All traffic from `snet-web` to the internet and to the on-premises subnets must be routed through the Azure Firewall.
- All traffic within the `vnet-prod-spoke` virtual network must route directly between resources and must not go through the Azure Firewall.
- The solution must minimize administrative overhead and avoid configuring individual routes for each on-premises subnet.

Which two actions should you perform to meet the requirements?

A financial services firm is modernizing its payment processing platform by migrating key workloads to Azure. The architecture team is designing a load balancing and traffic delivery solution that must meet the following requirements:

* External client transactions over HTTPS must be routed globally to regional endpoints using path-based rules (e.g., routing `/process` and `/refund` requests to dedicated backend services) with SSL/TLS termination performed at the edge.
* The internal backend database tier, which communicates over TCP port $1433$, must be load-balanced regionally across virtual machines in a virtual network.
* The database virtual machines currently have legacy Basic SKU Public IP addresses assigned for administrative access.
* The solution must support high-availability configurations for all load balancers without validation or deployment failures.

Which architecture configuration should you recommend to meet these requirements?

An organization is designing a secure hybrid network environment in Azure. A subnet named Subnet-App in VNet1 hosts virtual machines that must connect to the following resources:
- An Azure Key Vault named vault1 via a Private Endpoint deployed in Subnet-PE (IP range 10.0.2.0/24) in VNet1.
- An Azure Storage account named storage1 via a Private Endpoint deployed in Subnet-PE.
- Microsoft Entra ID for authentication.
- A public partner API (api.partner.com).

The design must satisfy the following requirements:
- Minimize administrative effort when Azure public IP addresses change.
- Route all public internet traffic (including api.partner.com) through an Azure Firewall in a peered hub virtual network.
- Restrict outbound traffic from Subnet-App using a Network Security Group (NSG) to block all outbound traffic by default, except for the minimum necessary traffic required to meet the connectivity requirements.

Which configuration should you recommend for the route table and NSG outbound rules on Subnet-App?

You are designing the compute infrastructure for a manufacturing telemetry processing service. The service will run on Azure Virtual Machines.

The requirements are as follows:
- The virtual machines must achieve a cumulative uptime Service Level Agreement (SLA) of $99.99\%$.
- The virtual machines must be protected against localized datacenter failures (such as power or cooling outages).
- Network latency between the virtual machines must be minimized to support real-time stream aggregation.

Which two design actions should you include in the compute architecture? (Select two.)

An enterprise is designing a hybrid network architecture to connect an on-premises datacenter to an Azure virtual network named `VNet1` using an ExpressRoute connection. A subnet in `VNet1` named `Subnet1` hosts virtual machines that must access an Azure SQL Database.

The design must meet the following requirements:
- The Azure SQL Database must not expose a public endpoint and must be accessible only via a private IP address within `VNet1`.
- On-premises applications must be able to resolve the database's fully qualified domain name (FQDN) to its private IP address.
- Outbound traffic from `Subnet1` to the database must be restricted at the network layer using Network Security Groups (NSGs).
- Administrative effort for managing DNS routing and network security rules must be minimized.

Which design should you recommend?