Examkin

Tüm alıştırma soruları

1198 soru

Tüm türler1,198Çoktan seçmeli617Çoklu seçim502Eşleştirme65Sıralama14
Soru 1081Soru →

A company is designing a serverless solution to process daily large-scale data exports from an on-premises ERP system. The processing job runs once per day, takes approximately 1515 minutes to complete, and requires a custom Python environment with specific system-level dependencies. The solution must minimize administrative overhead and ensure that compute resources are billed only during the execution of the job. Which Azure compute solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps jobs to run the containerized processing script

Cevap

Azure Container Apps jobs to run the containerized processing script
Azure Container Apps jobs are optimized for run-to-completion tasks, support custom container environments, scale dynamically, and charge only for the execution duration, avoiding the timeout limit of standard consumption functions.

Adım Adım Çözüm

1
Analyze the execution duration and environment requirements
The job takes 1515 minutes, exceeding the 1010-minute limit of some serverless offerings, and requires custom system-level Python dependencies.
This rules out basic Azure Functions Consumption plans due to the timeout limitation.
2
Evaluate the administrative overhead and pricing model requirements
The solution must minimize administrative overhead and only bill for execution time.
This rules out AKS due to management overhead and VM scale sets/App Service plans due to continuous idle costs.
3
Select the optimal serverless option for run-to-completion containerized tasks
Azure Container Apps jobs satisfy the custom environment (via containers), run-to-completion execution without a 1010-minute limit, minimal overhead, and scale-to-zero billing model.
It matches all constraints perfectly.

Anahtar Kavram

Selecting serverless compute services based on execution duration, custom dependencies, and hosting requirements.
Soru 1082Soru →

An organization named Novis Analytics is designing a secure three-tier application architecture in Azure. The application will be deployed within a single virtual network subnet named WorkloadSubnet and consists of three groups of Azure Virtual Machines (VMs) running the following workloads:

* Web front-ends
* Application back-ends
* Database administrators

The design must satisfy the following security and operational requirements:

* Web front-ends must only be allowed to communicate outbound to the application back-ends.
* Application back-ends must be allowed to make outbound HTTPS requests to an Azure Key Vault and an Azure SQL Database.
* Database administrators must be allowed to access the Azure SQL Database, but must be blocked from accessing the Azure Key Vault.
* All other outbound internet traffic from the subnet must be blocked.
* Administrative effort must be minimized, and security policies must automatically apply to new VM instances added to any tier without updating network security rule definitions.

Which network security design should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and use the AzureKeyVault and Sql Service Tags as destinations for outbound rules.

Cevap

Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and use the AzureKeyVault and Sql Service Tags as destinations for outbound rules.
Using Application Security Groups (ASGs) allows the organization to group virtual machines based on their workload roles (Web, Application, Database Administrators) and apply security rules to those groups, ensuring that any new VM associated with an ASG automatically inherits the correct security rules. Associating a single Network Security Group (NSG) at the subnet level minimizes administrative effort compared to managing NSGs per network interface. Using built-in Service Tags (AzureKeyVault and Sql) as destinations simplifies rule management by using Azure-managed IP address ranges instead of manually maintaining public IP lists, which change over time.

Adım Adım Çözüm

1
Group virtual machines by workload using Application Security Groups (ASGs).
Three ASGs are created, allowing VM network interfaces to be dynamically associated with their respective workloads.
This allows security policies to automatically apply to new VM instances as they are provisioned without modifying the security rule definitions.
2
Associate a single Network Security Group (NSG) at the subnet level (WorkloadSubnet).
Outbound and inbound network traffic for all VMs in the subnet is controlled centrally.
Associating the NSG with the subnet minimizes administrative overhead compared to managing individual NSGs on every VM network interface.
3
Configure NSG rules using the ASGs as sources and destinations, and the built-in Service Tags as destinations.
Rules are created allowing application back-ends to access AzureKeyVault and Sql tags, and database administrators to access the Sql tag, while blocking other traffic.
Using system-defined Service Tags avoids the need to manually maintain public IP addresses of Azure services, reducing administrative overhead.

Anahtar Kavram

Azure Application Security Groups (ASGs) allow you to configure network security as an extension of an application's structure, grouping VMs and defining network security policies based on those groups. Network Security Groups (NSGs) combined with Service Tags allow you to secure traffic to Azure PaaS services without manually maintaining IP address ranges.
Soru 1083Soru →

An insurance firm is designing the Azure compute virtualization solution for its core claims processing system. The system requires two distinct compute environments:

* Claims Web API: A customer-facing API that processes incoming claims, requires memory-optimized virtual machines (high memory-to-vCPU ratio) to handle large session states, and must maintain an availability SLA of 99.99%.
* Reporting Generator: A batch workload that runs overnight to aggregate daily claims reports. The processing can tolerate interruptions, and the primary design constraint is minimizing operational costs.

Which virtualization solution meets the requirements for both workloads?

Cevabı ve açıklamayı göster

Cevap: Deploy the Claims Web API on E-series Virtual Machines across multiple Availability Zones using a Virtual Machine Scale Set, and deploy the Reporting Generator on Spot Virtual Machines.

Cevap

Deploy the Claims Web API on E-series Virtual Machines across multiple Availability Zones using a Virtual Machine Scale Set, and deploy the Reporting Generator on Spot Virtual Machines.
The correct solution uses memory-optimized E-series Virtual Machines in a Virtual Machine Scale Set spread across multiple Availability Zones to ensure high availability (99.99% SLA) and proper resource sizing. For the non-critical, interruptible batch workload, Spot Virtual Machines are used to minimize costs.

Adım Adım Çözüm

1
Analyze the Claims Web API requirements.
The API requires memory-optimized virtual machines (high memory-to-vCPU ratio) and a high availability SLA of 99.99%.
This rules out compute-optimized (F-series) or storage-optimized (Ls-series) VMs, and demands deployment across multiple Availability Zones to meet the SLA.
2
Analyze the Reporting Generator requirements.
The reporting generator is a batch workload running overnight, which can tolerate interruptions and must minimize costs.
This makes it a perfect candidate for Spot Virtual Machines, which offer significant discounts. Azure Functions on a Consumption plan are ruled out due to the 10-minute timeout limit for long-running batch jobs.
3
Select the option that combines both correct services and deployment strategies.
The combination of E-series VMs in a multi-zone Virtual Machine Scale Set for the API and Spot VMs for the reporting workload meets all constraints.
This is the only configuration that satisfies both the performance/SLA targets of the API and the cost-optimization targets of the batch reporter without violating system limits.

Anahtar Kavram

Selecting Azure VM series and deployment architectures based on availability, performance, and cost constraints.
Soru 1084Soru →

A company named Veridia Tech deploys a three-tier web application to Azure. The application consists of web servers, application servers, and database servers, all hosted on Azure Virtual Machines within a single subnet named WorkloadSubnet. You need to design a network security solution that meets the following requirements:
- Restricts network traffic so that web servers can only communicate with application servers, and application servers can only communicate with database servers.
- Prevents direct network communication between web servers and database servers.
- Automatically applies the traffic restrictions to new virtual machines as they are provisioned.
- Minimizes administrative overhead by avoiding the management of individual IP addresses or the creation of separate subnets.

Which component should you include in the network security design?

Cevabı ve açıklamayı göster

Cevap: Application Security Groups (ASGs) associated with the network interfaces of the virtual machines

Cevap

Application Security Groups (ASGs) associated with the network interfaces of the virtual machines
The correct solution uses Application Security Groups (ASGs) to group virtual machines by role (Web, Application, Database) and defines NSG rules using these ASGs. Because ASGs are associated with the network interfaces of the virtual machines, any newly provisioned virtual machine assigned to an ASG automatically inherits the network security rules without requiring manual updates to the NSGs or IP configurations. This achieves the required traffic isolation within a single subnet while minimizing administrative effort.

Adım Adım Çözüm

1
Define Application Security Groups (ASGs) for the different application roles: Web, Application, and Database.
Three logical groups are created in Azure that can be referenced in Network Security Group (NSG) rules.
This allows referencing these groups as sources or destinations instead of using specific IP addresses or subnets.
2
Associate the respective ASGs with the network interfaces of the virtual machines belonging to each tier.
The virtual machines are dynamically grouped according to their application functions.
This ensures that any new virtual machine assigned to an ASG automatically inherits the security policies associated with that group.
3
Configure NSG rules on the WorkloadSubnet that allow traffic between the Web and Application ASGs, and between the Application and Database ASGs, while blocking other traffic.
Traffic flow is secured such that Web cannot talk directly to Database, while App can communicate with both Web and Database.
This implements the required network isolation policies dynamically and with minimal administrative overhead.

Anahtar Kavram

Using Application Security Groups (ASGs) to define context-aware network security policies within a single subnet, reducing administrative complexity and enabling dynamic scaling.
Tahmini Süre:1m 30s
Soru 1085Soru →

An organization is designing a serverless backend solution to process data analysis batches. Each batch job takes up to 25 minutes to complete. The solution must auto-scale to meet demand, minimize cost when idle, and require minimal management overhead.

Which two Azure compute options should you recommend for hosting the batch jobs?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Functions on a Premium plan; Azure Container Apps jobs

Cevap

Azure Functions on a Premium plan and Azure Container Apps jobs are the recommended choices.
The correct options are Azure Functions on a Premium plan and Azure Container Apps jobs. Azure Functions on a Premium plan allows execution times up to 30 minutes (and can be configured to be unbounded) and scales dynamically, avoiding the strict 10-minute timeout limit of the Consumption plan. Azure Container Apps jobs are built specifically for processing containerized, run-to-completion batch tasks without a strict 10-minute timeout constraint, scaling to zero when no jobs are running. Both options offer a serverless model that minimizes management overhead and cost when idle.

Adım Adım Çözüm

1
Evaluate the execution timeout constraint
The execution takes 25 minutes, ruling out options with a 10-minute timeout limit.
Azure Functions on a Consumption plan has a hard 10-minute timeout limitation, making it unsuitable.
2
Evaluate operational overhead and scaling constraints
Identify compute platforms that scale to zero, minimize idle costs, and require minimal infrastructure management.
Azure Kubernetes Service (AKS) requires management of clusters and nodes, violating the minimal management requirement, whereas Azure Functions and Azure Container Apps jobs are serverless and managed.
3
Confirm compatible serverless hosting models
Azure Functions on a Premium plan and Azure Container Apps jobs satisfy both the 25-minute execution requirement and the serverless management and scaling constraints.
Both selected plans support long-running tasks and automatically scale down to zero when idle.

Anahtar Kavram

Selecting serverless hosting options based on execution duration limits, scaling behavior, and operational overhead.
Tahmini Süre:2m 0s
Soru 1086Soru →

A gaming company is deploying a new online multiplayer game on Azure. The system architecture requires two distinct compute tiers:

1. Matchmaking Service: A production-grade backend service that manages active player sessions and matchmaking. It runs 24/724/7, requires a 99.95%99.95\% availability SLA, and must not experience unexpected virtual machine (VM) termination.
2. Telemetry Log Processor: A background worker service that aggregates and processes player telemetry metrics. The processing can be interrupted and resumed later without data loss.

To maximize availability for the Matchmaking Service and minimize costs for the Telemetry Log Processor, which compute configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy the Matchmaking Service instances across multiple Availability Zones using standard Virtual Machines (VMs), and host the Telemetry Log Processor on Azure Spot VMs.

Cevap

Deploy the Matchmaking Service instances across multiple Availability Zones using standard Virtual Machines (VMs), and host the Telemetry Log Processor on Azure Spot VMs.
The correct option ensures the production matchmaking service has a high availability SLA by spreading standard VMs across multiple Availability Zones, and optimizes cost by using low-cost Spot VMs for the interruptible telemetry service.

Adım Adım Çözüm

1
Analyze the requirements for the Matchmaking Service.
The service is production-grade, runs 24/724/7, requires a 99.95%99.95\% SLA, and cannot tolerate unexpected VM terminations.
This rules out Azure Spot VMs due to the risk of eviction and mandates a multi-zone VM deployment to achieve the required SLA.
2
Analyze the requirements for the Telemetry Log Processor.
The workload is a background process that is interruptible and can resume without data loss.
This makes the workload an ideal candidate for Azure Spot VMs, which provide deep discounts but can be evicted.
3
Combine the compute solutions to meet all constraints while optimizing cost.
Standard VMs in a multi-zone layout for matchmaking ensure high availability, and Spot VMs for telemetry optimize cost.
This meets both the SLA requirements for the critical tier and the cost-reduction requirements for the batch tier.

Anahtar Kavram

Selecting Azure VM tiers (Standard vs Spot) and Availability Zone configurations based on SLA and workload characteristics.
Soru 1087Soru →

Ember Healthcare is designing the network security architecture for a new application in Azure. The application architecture includes an Azure SQL Database logical server and an Azure Storage account. The local corporate network is connected to Azure using an ExpressRoute circuit with private peering.

You must design a network solution that meets the following requirements:
- The Azure SQL Database and Azure Storage account must not accept any connections from the public internet.
- On-premises users must be able to securely connect to the SQL Database and Storage account using their respective Fully Qualified Domain Names (FQDNs) over the private connection.
- The solution must minimize the administrative overhead of deploying and maintaining virtual machine-based DNS forwarders.
- Inbound and outbound access to the Azure subnets must be secured using Network Security Groups (NSGs) while minimizing the need to manually update rule IP addresses when Microsoft updates their service ranges.

Which two actions should you include in the recommended design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Azure Private Endpoints for the Azure SQL Database and the Azure Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint to resolve the private DNS zones from the on-premises network.; Configure Network Security Groups (NSGs) on the subnets that utilize built-in Azure Service Tags instead of individual IP address ranges to control network traffic to Azure services.

Cevap

The recommended design must include deploying Azure Private Endpoints combined with an Azure Private DNS Resolver inbound endpoint, and configuring Network Security Groups utilizing built-in Azure Service Tags.
Deploying Private Endpoints ensures that PaaS resources are assigned private IP addresses within the virtual network. The Azure Private DNS Resolver provides a managed inbound endpoint that on-premises DNS servers can target via conditional forwarders, resolving the private DNS zones without the need to manage custom DNS forwarder virtual machines. In addition, using Azure Service Tags in NSGs allows the platform to automatically manage the underlying IP addresses for specific Azure services, eliminating the administrative burden of manually updating rules when Microsoft modifies service IP ranges.

Adım Adım Çözüm

1
Address private access and DNS requirements.
Recommend Azure Private Endpoints for the SQL Database and Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint.
Private Endpoints satisfy the requirement to block public internet access. The Private DNS Resolver enables on-premises DNS resolution for these private endpoints without requiring VM-based forwarders.
2
Address the subnet access control and administrative overhead requirements.
Configure Network Security Groups on the subnets using built-in Azure Service Tags.
Service Tags automatically track Microsoft's service IP address ranges, securing access to Azure services while eliminating the need for manual rule updates.

Anahtar Kavram

Azure Private Access and Managed Name Resolution over Hybrid Connections
Soru 1088Soru →

A gaming company is designing the compute layer for a real-time multiplayer matchmaking and session hosting application. The backend will run on Azure Virtual Machines. The design must meet the following requirements:
- Provide a virtual machine uptime SLA of at least 99.99%99.99\%.
- Minimize network latency between the application servers.

Which two actions should you include in the design? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machines across two or more Availability Zones in the same region.; Deploy the virtual machines within a Proximity Placement Group.

Cevap

To design a compute solution that meets both the 99.99%99.99\% uptime SLA and the low-latency requirements, you should deploy the virtual machines across two or more Availability Zones in the same region and place them within a Proximity Placement Group.
Deploying virtual machines across two or more Availability Zones ensures the design meets the 99.99%99.99\% VM uptime SLA. Placing these virtual machines within a Proximity Placement Group ensures they are physically located close to one another to minimize inter-VM network latency.

Adım Adım Çözüm

1
Analyze the SLA requirement.
The application requires an uptime SLA of at least 99.99%99.99\%.
In Azure, a 99.99%99.99\% VM uptime SLA is only guaranteed when two or more virtual machines are deployed across two or more Availability Zones in the same region. Availability Sets only provide a 99.95%99.95\% SLA.
2
Analyze the latency requirement.
The application requires minimized network latency between the virtual machines.
A Proximity Placement Group is a physical co-location grouping that ensures virtual machines are placed as close to each other as possible within a datacenter, thereby reducing inter-VM network latency.
3
Evaluate cost and operational constraints.
Exclude options that do not support high availability or the specified protocol features.
Spot VMs do not offer any uptime SLA and are subject to eviction, making them unsuitable for high availability. Azure Traffic Manager operates at the DNS level and does not support SSL offloading.

Anahtar Kavram

Designing high availability compute infrastructure using Azure Availability Zones and Proximity Placement Groups to balance uptime SLA and network latency.
Tahmini Süre:2m 0s
Soru 1089Soru →

A financial services company is designing the Azure compute virtualization infrastructure for a new multi-tier application. The architecture has two primary workloads:

1. Production Database Tier: A transactional database cluster that requires high write throughput and must achieve a 99.99%99.99\% virtual machine uptime SLA.
2. Development Testing Tier: A batch-oriented build-and-test environment that can tolerate interruptions and does not have a strict SLA. The primary objective is to minimize compute costs.

Which two compute configurations should you include in the design to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the Production Database Tier virtual machines across two or more Availability Zones in the same Azure region.; Deploy the Development Testing Tier virtual machines as Azure Spot Virtual Machines.

Cevap

Deploy the production database virtual machines across two or more Availability Zones and deploy the development testing virtual machines as Azure Spot Virtual Machines.
To satisfy the 99.99%99.99\% SLA constraint for the Production Database Tier, you must deploy virtual machines across multiple Availability Zones in the same Azure region. To satisfy the low-cost constraint for the Development Testing Tier, which is tolerant of interruptions, you should deploy the virtual machines as Azure Spot VMs to leverage deep discounts.

Adım Adım Çözüm

1
Analyze the SLA requirement for the Production Database Tier.
The Production Database Tier requires a 99.99%99.99\% VM uptime SLA.
This determines the minimum high-availability configuration required for the production compute layer.
2
Evaluate availability options for the Production Database Tier.
Deploying virtual machines across multiple Availability Zones in the same region satisfies the 99.99%99.99\% SLA, whereas Availability Sets only guarantee 99.95%99.95\% SLA.
To select the architecture that meets the SLA while avoiding single-point-of-failure vulnerabilities.
3
Analyze the cost and interruption tolerance of the Development Testing Tier.
The Development Testing Tier requires minimal cost and can be interrupted.
To select the most cost-effective virtual machine type, which points to Azure Spot Virtual Machines.

Anahtar Kavram

Selecting appropriate compute availability options and cost tiers based on workload SLA and interruption tolerance.
Soru 1090Soru →

Vortex Logistics is designing a secure architecture in Azure. They have a virtual network named VNet1 that contains a subnet named BackendSubnet. The virtual machines in BackendSubnet need to access an Azure Storage account named store1 and an Azure SQL Database named db1 privately without exposing the data traffic to the public internet. The solution must minimize administrative overhead and avoid using static IP listings or manual routing updates. Which two actions should you include in the design to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create Private Endpoints for store1 and db1 within BackendSubnet.; Configure Azure Private DNS zones integrated with VNet1 to resolve the fully qualified domain names (FQDNs) of store1 and db1.

Cevap

To meet the requirements, you should create Private Endpoints for the storage account and SQL database within the backend subnet, and configure Azure Private DNS zones integrated with the virtual network to handle FQDN resolution.
Creating Private Endpoints assigns private IP addresses from the subnet to the Azure Storage account and Azure SQL Database, ensuring that all data traffic remains within the private Microsoft backbone network and is not exposed to the public internet. Because Private Endpoints require proper name resolution to resolve the service FQDNs to these private IPs, configuring and linking Azure Private DNS zones is necessary to ensure virtual machines can connect successfully.

Adım Adım Çözüm

1
Identify the need for private, non-public internet exposure for Azure PaaS services (Storage and SQL Database) while avoiding manual IP maintenance.
Determine that Private Endpoints are the appropriate technology to assign private IPs to the PaaS resources.
Private Endpoints provide secure private IP connectivity and block public internet exposure.
2
Determine the DNS resolution mechanism for Private Endpoints.
Decide to configure Private DNS Zones for both storage and SQL database services and link them to the virtual network.
Clients must resolve the standard service FQDNs to the new private endpoint IPs to ensure seamless application connectivity.

Anahtar Kavram

Implementing private access to Azure PaaS resources using Private Endpoints and Private DNS Zones to secure data traffic and avoid public internet exposure.
Soru 1091Soru →

A company plans to migrate its legacy ERP system from an on-premises datacenter hosting physical servers and VMware vSphere virtual machines to Azure.

The system requirements and constraints are:
- The inventory consists of 40 virtual machines running on VMware vSphere and 5 physical servers running specialized processing software.
- The database tier runs on SQL Server on-premises, using SQL Server Agent jobs for nightly ETL tasks and cross-database queries between two databases on the same instance.
- Users will authenticate using their existing on-premises Active Directory Domain Services (AD DS) credentials. No advanced federation features (such as certificate-based authentication or smart cards) are required, but minimizing infrastructure overhead and deployment complexity is critical.
- You need to map application dependencies for all servers to identify migration groups, ensuring that network connection details (ports, IP addresses) are captured for security group planning.

Which two actions should you include in the migration assessment and strategy? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure agentless dependency mapping for the VMware virtual machines, and install the Azure Monitor agent and Dependency agent on the physical servers to enable agent-based dependency mapping.; Recommend Azure SQL Managed Instance as the target database tier, and run the Azure SQL migration assessment using Azure Migrate to evaluate compatibility.

Cevap

The correct strategy involves combining agentless dependency mapping for VMware virtual machines with agent-based dependency mapping for physical servers, and recommending Azure SQL Managed Instance as the target database tier to support cross-database queries and SQL Server Agent jobs.
The correct strategy involves combining agentless dependency mapping for VMware virtual machines with agent-based dependency mapping for physical servers, as physical servers do not support agentless discovery for network connections. Additionally, since the application requires SQL Server Agent and cross-database queries, Azure SQL Managed Instance is the required target database tier, and performing a compatibility assessment is necessary to identify any migration blockers.

Adım Adım Çözüm

1
Analyze the virtual and physical server inventory and determine the appropriate dependency mapping method.
VMware virtual machines can use agentless dependency mapping, while the physical servers require agent-based dependency mapping with the Azure Monitor agent and Dependency agent.
Agentless dependency mapping is not supported for physical servers in Azure Migrate, so a hybrid dependency strategy is required.
2
Evaluate the on-premises SQL Server requirements, specifically cross-database queries and SQL Server Agent.
Identify Azure SQL Managed Instance as the appropriate target database tier.
Azure SQL Database single databases or elastic pools do not support native cross-database queries or SQL Server Agent jobs, which are legacy requirements.
3
Analyze the identity synchronization requirements for hybrid authentication.
Determine that Microsoft Entra Password Hash Synchronization (PHS) with Seamless SSO is the optimal identity synchronization mechanism.
Using PHS with Seamless SSO minimizes infrastructure overhead and complexity compared to deploying AD FS, as there are no requirements for advanced federation features.

Anahtar Kavram

Selecting the correct assessment tools, dependency mapping strategies, and database target tiers during an Azure migration planning phase.
Tahmini Süre:3m 0s
Soru 1092Soru →

An IoT manufacturing enterprise is deploying a regional telematics processing solution in Azure. The architecture contains two main services:

1. An HTTP/HTTPS dashboard API that requires path-based routing (routing `/telemetry/*` to a hot-path processing pool and `/reports/*` to a cold-path pool) and SSL/TLS termination at the gateway.
2. A raw TCP receiver service running on port 5001 that processes stream data directly from hardware sensors.

The design requires zone-redundancy and high availability across three Availability Zones. The virtual machines hosting the TCP receiver service currently use Basic SKU Public IP addresses to support direct remote debugging over the internet.

Which load balancing configuration should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API. Upgrade the public IP addresses of the TCP receiver virtual machines to Standard SKU, and deploy a Standard Load Balancer to distribute the TCP traffic.

Cevap

Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API, upgrade the public IP addresses of the TCP receiver virtual machines to Standard SKU, and deploy a Standard Load Balancer to distribute the TCP traffic.
The recommended design uses Azure Application Gateway Standard v2 for the regional HTTP/HTTPS path-based routing and SSL/TLS termination, and a Standard Load Balancer for the Layer 4 TCP receiver service. To prevent validation failures, the virtual machines' public IPs must be upgraded to Standard SKU because Standard Load Balancer backend pools do not support Basic SKU public IPs.

Adım Adım Çözüm

1
Select the load balancer for the Layer 7 web traffic.
Azure Application Gateway Standard v2 is chosen because it supports regional zone redundancy, path-based routing, and SSL/TLS termination.
The dashboard API requires path-based routing (/telemetry/* and /reports/*) and SSL termination at the gateway level.
2
Select the load balancer for the Layer 4 TCP receiver traffic.
Standard Load Balancer is chosen over Basic Load Balancer.
The TCP service must support high availability across three Availability Zones, which requires a Standard SKU Load Balancer since Basic Load Balancer does not support zone-redundancy.
3
Address backend SKU compatibility requirements.
All VM instance-level Public IPs in the backend pool must be upgraded to Standard SKU.
Standard Load Balancers fail validation if associated with virtual machines that have Basic SKU Public IP addresses.

Anahtar Kavram

Designing a co-existing Layer 7 (Application Gateway) and Layer 4 (Standard Load Balancer) regional solution with proper SKU alignment for public-facing virtual machines across Availability Zones.
Soru 1093Soru →

A healthcare provider is designing a serverless architecture to ingest and process HL7 clinical data messages and host a lightweight REST API. The REST API will receive incoming message metadata and must respond within 200200 milliseconds to the sender. The clinical data messages are processed asynchronously by a background worker that can take up to 2020 minutes to complete the analysis and transformation for each message. The architecture must minimize administrative overhead and ensure that compute costs are reduced to zero during periods of inactivity. Which of the following Azure services should you recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps jobs to run the background worker; Azure Functions on a Consumption plan to host the REST API

Cevap

The architecture should include Azure Container Apps jobs to run the background worker and Azure Functions on a Consumption plan to host the REST API.
To process the 2020-minute background tasks while scaling to zero during inactivity, Azure Container Apps jobs is the correct choice because it does not suffer from the 1010-minute limit of serverless functions. To host the lightweight REST API with zero administrative overhead and zero cost during idle periods, Azure Functions on a Consumption plan is the most efficient choice.

Adım Adım Çözüm

1
Analyze execution duration constraints
The background job requires up to 2020 minutes to run. Standard serverless execution limits must be checked.
Azure Functions Consumption plan has a maximum execution limit of 1010 minutes, which makes it unsuitable for this background task.
2
Select hosting for the background worker
Azure Container Apps jobs can execute tasks that run for hours to completion and can scale down to zero when idle.
This satisfies the duration requirements while keeping costs to zero during periods of inactivity with minimal overhead.
3
Select hosting for the REST API
Azure Functions on a Consumption plan is cost-effective, scales to zero, and has minimal administrative overhead.
The REST API only handles metadata ingestion, which fits within the execution window and low-latency bounds of serverless functions.

Anahtar Kavram

Selecting Azure serverless hosting options based on execution limits, administrative overhead, and scaling behaviors.
Tahmini Süre:1m 30s
Soru 1094Soru →

Your company is designing a hybrid network in Azure using a hub-and-spoke topology. The architecture includes:

* A hub virtual network named `vnet-hub-central` with an address space of 172.16.0.0/16172.16.0.0/16.
* A spoke virtual network named `vnet-spoke-app` with an address space of 172.17.0.0/16172.17.0.0/16.
* A spoke virtual network named `vnet-spoke-data` with an address space of 172.18.0.0/16172.18.0.0/16.
* An Azure ExpressRoute gateway deployed in the `GatewaySubnet` (172.16.2.0/24172.16.2.0/24) of `vnet-hub-central` connecting to the on-premises network.
* A third-party network virtual appliance (NVA) deployed in `vnet-hub-central` to inspect all transit traffic.
* An Azure Route Server deployed in the `RouteServerSubnet` (172.16.1.0/24172.16.1.0/24) of `vnet-hub-central`.

You need to configure the network to ensure that the spoke virtual networks dynamically exchange routing information with the on-premises network via the NVA, minimizing manual route table maintenance.

Which three actions should you perform? (Each correct answer presents part of the solution.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure BGP peering between the NVA and the Azure Route Server.; Enable the Branch-to-Branch (route exchange) setting on the Azure Route Server.; Configure the virtual network peerings from the hub to the spokes to allow gateway transit, and the peerings from the spokes to the hub to use the remote virtual network's gateway or Route Server.

Cevap

To configure dynamic hybrid routing using Azure Route Server and an NVA, you must configure BGP peering between the NVA and the Azure Route Server, enable the Branch-to-Branch route exchange setting on the Route Server, and configure VNet peering transit options ('Use remote virtual network's gateway or Route Server' on spokes, and allow gateway transit on the hub).
The correct configuration relies on dynamic route exchange using Azure Route Server (ARS). Configuring BGP peering between the NVA and ARS allows the NVA to advertise its routes to the Azure SDN. Enabling Branch-to-Branch (route exchange) on the ARS allows the Route Server to propagate BGP routes between the ExpressRoute gateway and the NVA. Finally, configuring the virtual network peering options ensures that the spoke VNets dynamically receive these routes from the hub's Route Server.

Adım Adım Çözüm

1
Configure BGP Peering on the NVA and Route Server.
The NVA and Azure Route Server establish a BGP session.
This allows the NVA to dynamically advertise routes (like on-premises subnets) to the Route Server, which handles route propagation inside the Azure VNets.
2
Enable Branch-to-Branch on Azure Route Server.
Route Server exchanges routes between the ExpressRoute gateway and the NVA.
This allows the ExpressRoute gateway to learn the routes advertised by the NVA, and the NVA to learn on-premises routes advertised by the ExpressRoute gateway, facilitating transit routing.
3
Configure Peering Transit Settings.
Spoke virtual networks dynamically receive the propagated routes from the Route Server.
VNet peerings must be configured to allow gateway/Route Server transit so that the spokes can inherit the routes learned by the hub's Route Server.

Anahtar Kavram

Azure Route Server simplifies dynamic routing between network virtual appliances (NVAs) and virtual networks by establishing BGP peering, eliminating the need to maintain static User Defined Routes (UDRs) across multiple subnets.
Soru 1095Soru →

A company named Vortex Retail is designing a secure network environment for a payment processing system. The system runs on Azure Virtual Machines deployed in a subnet named PaymentSubnet within a virtual network named VNet-Prod. The virtual machines must meet the following requirements:
- Access an Azure Storage Account named paystorage securely without routing traffic over the public internet.
- Connect to Azure Key Vault to retrieve cryptographic keys.
- Communicate with Microsoft Entra ID for identity verification and Azure Monitor for telemetry ingestion.
- Block all other outbound traffic to the public internet.
- Minimize administrative effort and avoid manually maintaining IP address lists.

You need to recommend the network security and private access architecture for the virtual machines.

Which configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the AzureActiveDirectory and AzureMonitor service tags, followed by a rule to deny the Internet service tag.

Cevap

Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the AzureActiveDirectory and AzureMonitor service tags, followed by a rule to deny the Internet service tag.
Deploying Private Endpoints assigns private IP addresses from the virtual network to the storage account and key vault. Traffic to these resources is routed internally and is permitted by default. Outbound access to public endpoints (Microsoft Entra ID and Azure Monitor) is allowed using the AzureActiveDirectory and AzureMonitor service tags, which dynamically update, eliminating the need to maintain IP ranges. The catch-all deny rule for the Internet service tag blocks all other public outbound traffic.

Adım Adım Çözüm

1
Select the appropriate private access method for Azure Storage and Azure Key Vault.
Private Endpoints are chosen because they map the resources to private IP addresses within the virtual network, ensuring traffic stays off the public internet.
This meets the requirement of securing storage and key vault access without public internet exposure.
2
Determine the rule strategy for outbound traffic to Microsoft Entra ID and Azure Monitor.
Configure outbound NSG rules allowing the AzureActiveDirectory and AzureMonitor service tags.
Service tags abstract the management of IP ranges, satisfying the requirement to minimize administrative effort.
3
Configure the rule to restrict all other outbound internet traffic.
Add an outbound NSG rule denying the Internet service tag at a lower priority than the allow rules.
This blocks all unauthorized outbound internet traffic while preserving access to the allowed service tags and private endpoints.

Anahtar Kavram

Azure Private Endpoints allow secure, private access to Azure resources using private IP addresses from the virtual network. Service Tags simplify outbound NSG configurations for public Azure services by abstracting IP address management.
Soru 1096Soru →

An enterprise is modernizing a global HR SaaS application. The application consists of two main tiers:

1. A web application tier (HTTP/HTTPS) that requires SSL/TLS termination, URL path-based routing (e.g., routing `/benefits/*` and `/payroll/*` to different backend pools), and global optimization to route users to the closest region (either East US or West Europe).
2. A background data-sync tier that communicates using a custom TCP protocol on port 9090, requiring high-throughput regional layer 4 load balancing in the East US region.

The existing virtual machines for the background data-sync tier in East US are configured with Basic SKU Public IP addresses.

You need to design the application load balancing and delivery solution to meet these requirements while preventing configuration validation errors.

Which of the following actions should you recommend? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Azure Front Door to route global HTTP/HTTPS traffic, terminate SSL, and perform URL path-based routing for the web application tier.; Deploy a Standard Load Balancer to distribute the custom TCP traffic for the background data-sync tier, and upgrade the background VMs' Public IPs to Standard SKU.

Cevap

To meet the global routing, path-based routing, and SSL termination requirements for the HTTP/S web application tier, Azure Front Door is the appropriate service. For the regional TCP-based background data-sync tier, a Standard Load Balancer must be used; however, to prevent SKU mismatch validation errors, the associated virtual machines' Public IPs must be upgraded from Basic to Standard SKU.
The correct recommendations are to deploy Azure Front Door for the web tier and deploy a Standard Load Balancer for the background tier while upgrading the background virtual machines' Public IPs to the Standard SKU. Azure Front Door satisfies all global layer 7 requirements, including SSL termination, path-based routing, and global user optimization. The Standard Load Balancer handles regional TCP load balancing on port 9090. Upgrading the virtual machines' Public IPs to Standard SKU is necessary because Standard Load Balancers do not support backend resources with Basic SKU Public IPs, preventing configuration validation failures.

Adım Adım Çözüm

1
Analyze the requirements for the global web application tier.
Identify that global load balancing, HTTP/S protocol support, SSL/TLS termination, and URL path-based routing are required.
These layer 7 and global routing requirements point directly to Azure Front Door, as it manages global HTTP/S traffic with path routing and SSL offloading.
2
Analyze the requirements for the regional background data-sync tier.
Identify that regional load balancing on a custom TCP port (9090) is required.
A layer 4 load balancer is needed. Azure Load Balancer (Standard SKU) is the correct choice to handle non-HTTP/S TCP traffic regionally.
3
Evaluate the SKU compatibility for the regional load balancer configuration.
Identify that the existing virtual machines have Basic SKU Public IPs, which cannot be associated with a Standard Load Balancer backend pool.
To avoid a validation error caused by mixing Basic and Standard SKUs, the Public IPs on the background virtual machines must be upgraded to Standard SKU.

Anahtar Kavram

Selecting Azure load balancing services based on layer, scope, and SKU compatibility constraints.
Soru 1097Soru →

A company named Zephyr Retail is designing a network security solution for an Azure virtual network subnet named ProcessingSubnet. Virtual machines in ProcessingSubnet must be able to securely access Azure Storage and Azure Key Vault in the same Azure region. All other outbound access to the public internet must be blocked. The solution must minimize administrative overhead and ensure that network rules do not require manual updates when Azure service IP ranges change. Which configuration should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?

Cevabı ve açıklamayı göster

Cevap: Create outbound security rules in the NSG with the destination set to the Storage and AzureKeyVault Service Tags.

Cevap

Create outbound security rules in the NSG with the destination set to the Storage and AzureKeyVault Service Tags.
Using Service Tags like Storage and AzureKeyVault allows the Network Security Group to dynamically resolve destination IP addresses, ensuring secure and continuously updated access to these services with zero administrative overhead.

Adım Adım Çözüm

1
Identify the target public Azure services that the virtual machines need to reach.
Azure Storage and Azure Key Vault in the same region.
This establishes the scope of allowed outbound traffic.
2
Evaluate the administrative requirement to avoid manual IP range updates.
Individual IP addresses are ruled out; a dynamic grouping mechanism must be used.
Azure service IP ranges change frequently, so static IP rules create maintenance overhead.
3
Select the built-in Azure Network Security Group features designed for grouping service IP addresses.
Service Tags (specifically Storage and AzureKeyVault) are selected.
Service Tags are managed by Microsoft and automatically updated, satisfying the requirement to minimize administrative overhead.

Anahtar Kavram

Network Security Groups and Service Tags for outbound traffic filtering
Tahmini Süre:1m 30s
Soru 1098Soru →

An organization plans to migrate its legacy inventory management application to Azure. The current workload runs on 1515 physical bare-metal servers hosting Windows Server 20162016. The application uses a backend Microsoft SQL Server 20162016 instance containing multiple databases that rely on SQL Server Agent jobs and cross-database queries.

You need to design a migration assessment and transition strategy that meets the following requirements:
1. Identify and map all network dependencies, process communication paths, and ports across the 1515 physical servers using Azure Migrate.
2. Recommend a fully managed Azure SQL database hosting option that natively supports SQL Server Agent and cross-database queries.
3. Configure a hybrid identity synchronization method that allows on-premises Active Directory Domain Services (AD DS) users to authenticate to Azure resources without deploying any on-premises federation servers.

Which combination of solutions should you recommend?

Cevabı ve açıklamayı göster

Cevap: Perform agent-based dependency analysis by deploying the Azure Migrate appliance and installing the Azure Monitor Agent and Dependency Agent on each of the 1515 physical servers. Migrate the databases to Azure SQL Managed Instance. Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO).

Cevap

The strategy recommending agent-based dependency mapping using the Azure Monitor Agent and Dependency Agent, Azure SQL Managed Instance, and Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO
The option recommending agent-based dependency mapping, Azure SQL Managed Instance, and Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO is correct. Agent-based dependency mapping is mandatory for physical servers since agentless discovery and mapping are only supported for virtualized VMware and Hyper-V workloads. Azure SQL Managed Instance natively supports instance-level features like SQL Server Agent and cross-database queries. Finally, PHS with Seamless SSO provides authentication without requiring federation servers on-premises, satisfying the identity configuration constraints.

Adım Adım Çözüm

1
Determine the dependency mapping strategy for physical bare-metal servers.
Identify that Azure Migrate only supports agentless dependency mapping for VMware and Hyper-V environments. For physical servers, agent-based mapping using the Azure Monitor Agent and Dependency Agent is required.
Correctly matching the server type (physical bare-metal) to the supported Azure Migrate dependency mapping methodology.
2
Select the correct Azure SQL hosting tier for SQL Server features.
Select Azure SQL Managed Instance since it provides near-100% compatibility with on-premises SQL Server databases, natively supporting SQL Server Agent and cross-database queries, unlike Azure SQL Database single databases or elastic pools.
Ensuring application compatibility without code refactoring for database engine features.
3
Select the appropriate hybrid identity synchronization method.
Choose Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO) as it allows AD DS users to authenticate to Azure resources without deploying dedicated AD FS federation servers.
Aligning hybrid identity design with on-premises infrastructure constraints.
4
Synthesize the results to identify the matching option.
Select the option combining agent-based dependency analysis, Azure SQL Managed Instance, and PHS with Seamless SSO.
Ensuring all requirements are satisfied by a single option.

Anahtar Kavram

Migration Assessment and Strategy
Tahmini Süre:3m 0s
Soru 1099Soru →

An organization is designing the compute layer for a legacy line-of-business application on Azure. The application runs on two virtual machines that require low-latency communication and must reside in the same physical datacenter. The design must guarantee a virtual machine uptime SLA of at least 99.95% for the application. Which configuration should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the virtual machines in an Availability Set.

Cevap

Deploy the virtual machines in an Availability Set.
Deploying the virtual machines in an Availability Set ensures they are distributed across multiple physical hardware racks (fault domains) and update domains within a single datacenter. This configuration meets the 99.95% uptime SLA requirement for two or more VMs while keeping latency low by ensuring they remain within the same datacenter.

Adım Adım Çözüm

1
Analyze the application latency and placement constraints.
The virtual machines must reside in the same physical datacenter due to low-latency requirements.
This rules out deploying virtual machines across multiple Availability Zones, which would introduce cross-zone latency.
2
Evaluate the SLA requirements for virtual machine uptime.
The target virtual machine uptime SLA must be at least 99.95%.
A single VM with Premium SSD only provides a 99.9% SLA, which is insufficient. We need a multi-VM configuration.
3
Identify the high availability feature that provides a 99.95% SLA within a single datacenter.
An Azure Availability Set provides a 99.95% SLA by distributing VMs across update and fault domains within a single datacenter.
Deploying multiple VMs in a single Availability Zone without an Availability Set does not guarantee the distribution across hardware or the 99.95% SLA.

Anahtar Kavram

Azure Availability Sets provide 99.95% VM uptime SLA within a single datacenter by distributing VMs across update and fault domains.
Soru 1100Soru →

An enterprise is designing an Azure hub-and-spoke virtual network topology to support their internal workloads. The topology is configured as follows:

* The hub virtual network, `vnet-hub-core`, has an address space of 172.16.0.0/16172.16.0.0/16 and hosts an Azure Firewall at 172.16.1.4172.16.1.4.
* A spoke virtual network, `vnet-spoke-app`, has an address space of 172.18.0.0/16172.18.0.0/16 and contains a subnet named `subnet-app` (172.18.1.0/24172.18.1.0/24).
* A second spoke virtual network, `vnet-spoke-shared`, has an address space of 172.19.0.0/16172.19.0.0/16.
* Both spoke virtual networks are peered directly with `vnet-hub-core`. Spoke-to-spoke peering is not configured.

To meet corporate security policies, all traffic originating from `subnet-app` that is destined for the Internet, `vnet-spoke-shared`, and `vnet-hub-core` must be routed through the Azure Firewall for inspection.

An administrator associates a route table with `subnet-app` containing the following custom routes:

* Route 1: Address prefix 0.0.0.0/00.0.0.0/0, Next hop: Virtual appliance (172.16.1.4172.16.1.4)
* Route 2: Address prefix 172.16.0.0/12172.16.0.0/12, Next hop: Virtual appliance (172.16.1.4172.16.1.4)

Which routing behavior will occur for traffic originating from `subnet-app`?

Cevabı ve açıklamayı göster

Cevap: Traffic destined for the Internet and vnet-spoke-shared will route through the Azure Firewall, but traffic destined for vnet-hub-core will bypass the firewall and route directly through the peering connection.

Cevap

Traffic destined for the Internet and vnet-spoke-shared will route through the Azure Firewall, but traffic destined for vnet-hub-core will bypass the firewall and route directly through the peering connection.
The correct answer is correct because Azure routing uses the longest prefix match (LPM) rule. For traffic destined to the hub virtual network (172.16.0.0/16), the system route created by the virtual network peering (172.16.0.0/16) is a longer match (/16) than the user-defined route (172.16.0.0/12, which is /12). Therefore, the system route is preferred, and the traffic bypasses the firewall. For traffic destined to the second spoke (172.19.0.0/16), the system route for the peered hub does not match, so the user-defined route of 172.16.0.0/12 is the longest matching route and sends the traffic to the firewall.

Adım Adım Çözüm

1
Identify the system routes automatically generated for subnet-app in vnet-spoke-app.
The system routes include 172.18.0.0/16 (Local), 172.16.0.0/16 (VNet Peering to vnet-hub-core), and 0.0.0.0/0 (Internet). No route exists for 172.19.0.0/16 because peering is non-transitive.
Understanding system-defined routing is required before evaluating how custom user-defined routes (UDRs) modify behavior.
2
Evaluate the routing path for traffic destined for vnet-hub-core (172.16.0.0/16) by comparing route prefix lengths.
The destination matches both the system route 172.16.0.0/16 and the UDR 172.16.0.0/12. Since /16 is a longer prefix match than /12, the system route is preferred.
Azure routing utilizes Longest Prefix Match (LPM) to determine the next hop when multiple routes match a destination.
3
Evaluate the routing path for traffic destined for vnet-spoke-shared (172.19.0.0/16).
The destination matches the UDR 172.16.0.0/12 and UDR 0.0.0.0/0. The system route for the peered hub (172.16.0.0/16) does not match. The longest prefix match is the UDR 172.16.0.0/12, routing traffic to the firewall.
Since peering is non-transitive, no /16 system route exists for the other spoke, allowing the /12 UDR to successfully route this traffic to the firewall.

Anahtar Kavram

Azure routing selection prioritizes the longest prefix match (LPM) among all matching routes. A User Defined Route (UDR) with a shorter prefix length than a system-defined route will not override that system route.
Tahmini Süre:1m 30s
ÖncekiSayfa 55 / 60Sonraki