Examkin

Tüm alıştırma soruları

1198 soru

Tüm türler1,198Çoktan seçmeli617Çoklu seçim502Eşleştirme65Sıralama14
Soru 121Soru →

An educational institution wants to move its student grading database from a local server to Azure. The database configuration depends on SQL Server Agent to run automated weekly reports, and uses cross-database queries to reference records in a separate database on the same server.

Which two Azure SQL options support these requirements? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance; SQL Server on Azure Virtual Machines

Cevap

The correct database deployment options are Azure SQL Managed Instance and SQL Server on Azure Virtual Machines.
The correct options are Azure SQL Managed Instance and SQL Server on Azure Virtual Machines. Both options provide the compatibility required to support SQL Server Agent and cross-database queries. Azure SQL Managed Instance provides these capabilities as a fully managed service, whereas SQL Server on Azure Virtual Machines provides full feature parity with on-premises SQL Server instances.

Adım Adım Çözüm

1
Analyze the database requirements for the migration.
Identify that the database requires SQL Server Agent and cross-database queries.
Determining key technical dependencies is crucial for selecting the appropriate deployment tier.
2
Evaluate Azure SQL Database options (single database and elastic pool) against these requirements.
Rule them out as they do not natively support SQL Server Agent or cross-database queries.
Azure SQL Database focuses on hyper-scale single-database scenarios and lacks native support for several legacy instance-level features.
3
Evaluate Azure SQL Managed Instance and SQL Server on Azure VMs.
Confirm that both support SQL Server Agent and cross-database queries.
Azure SQL Managed Instance provides instance-level compatibility, and SQL Server on Azure VMs provides full SQL Server parity.

Anahtar Kavram

Identifying database compatibility requirements (such as SQL Server Agent and cross-database queries) to choose between Azure SQL Database, Azure SQL Managed Instance, and SQL Server on Azure Virtual Machines.
Tahmini Süre:1m 0s
Soru 122Soru →

You are designing a governance strategy for a multi-subscription Azure environment. You have two management groups and subscriptions structured as follows:
- A management group named Production-MG contains two subscriptions: Subscription A and Subscription B.
- Subscription B contains a resource group named External-Connectivity-RG.

You need to implement Azure Policies to meet the following requirements:
1. Ensure all Azure Virtual Machines deployed in Subscription A automatically have the Azure Monitor Agent installed.
2. Prevent the deployment of public IP addresses in Subscription B, except within the External-Connectivity-RG resource group.

Which two policy configurations should you implement to meet the requirements with the least amount of administrative overhead? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign a policy definition that deploys the Azure Monitor Agent using the DeployIfNotExists effect at the Subscription A scope.; Assign a policy definition that blocks public IP creation using the Deny effect at the Subscription B scope, and add the External-Connectivity-RG resource group to the assignment's exclusion (notScopes) list.

Cevap

Assign a policy definition that deploys the Azure Monitor Agent using the DeployIfNotExists effect at the Subscription A scope, and assign a policy definition that blocks public IP creation using the Deny effect at the Subscription B scope, while adding the External-Connectivity-RG resource group to the assignment's exclusion (notScopes) list.
To satisfy the requirement to automatically install the Azure Monitor Agent, you must use the DeployIfNotExists effect, which triggers a remediation task. To prevent public IP deployment at the subscription level while exempting a specific resource group, assigning the Deny effect with a notScopes exclusion target is the most efficient design.

Adım Adım Çözüm

1
Analyze Requirement 1: Automatically install the Azure Monitor Agent on VMs in Subscription A.
Identify that the DeployIfNotExists effect is the correct choice because it executes a template deployment to install the agent if it is missing from a newly created or updated VM resource.
DeployIfNotExists allows automatic remediation, whereas Deny would simply block the VM deployment and Audit would only report on compliance.
2
Analyze Requirement 2: Prevent the deployment of public IP addresses in Subscription B, with an exception for External-Connectivity-RG.
Identify that the Deny effect should be applied at the Subscription B scope to block public IP creation, and the External-Connectivity-RG resource group must be added to the notScopes parameter of the policy assignment to exclude it.
Deny stops the resource from being created, and using notScopes prevents the policy from being applied to that specific resource group, avoiding complex policy structures or duplicate assignments.

Anahtar Kavram

Azure Policy effects and assignment scope exclusions
Soru 123Soru →

Obsidian Systems is designing a hybrid identity and multi-tenant collaboration solution to integrate their on-premises Active Directory Domain Services (AD DS) forest, obsidian.local, with multiple Microsoft Entra ID tenants. The solution must adhere to strict authentication, provisioning, and business continuity requirements. Match each business requirement on the left to the most appropriate Microsoft Entra ID technology or configuration on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Evaluate on-premises account status and sign-in hours in real-time for cloud sign-ins without deploying Active Directory Federation Services (AD FS).
Provide cloud authentication that continues working during on-premises network outages with the least amount of infrastructure overhead.
Automate user account provisioning and lifecycle management across multiple distinct internal Microsoft Entra ID tenants.
Enable users from an external vendor using a non-Azure identity provider to authenticate using their own credentials without manual guest invitations.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

1 matches Pass-through Authentication (PTA), 2 matches Password Hash Synchronization (PHS), 3 matches Microsoft Entra Cross-Tenant Synchronization, and 4 matches SAML/WS-Fed Direct Federation.
Pass-through Authentication validates passwords on-premises in real-time to respect sign-in hours without AD FS. Password Hash Sync enables authentication to continue during local internet outages. Cross-Tenant Synchronization automates provisioning across internal Entra ID tenants. SAML/WS-Fed Direct Federation allows external users to authenticate using their non-Azure identity provider.

Adım Adım Çözüm

1
Analyze real-time security policy evaluation requirements.
Identify that Pass-through Authentication (PTA) delegates password validation to on-premises AD DS in real-time, enforcing sign-in hours instantly without AD FS infrastructure.
To satisfy the constraint of evaluating sign-in hours in real-time without AD FS.
2
Analyze business continuity and high availability requirements.
Identify that Password Hash Synchronization (PHS) handles authentication in the cloud, remaining active during local network outages with minimal agent overhead.
To satisfy the requirement that cloud authentication must not fail when the connection between the on-premises network and Azure is lost.
3
Analyze multi-tenant provisioning requirements.
Select Microsoft Entra Cross-Tenant Synchronization as it automates user synchronization and lifecycle management between Entra ID tenants.
To satisfy the need for automated provisioning of guest accounts across multiple internal tenants.
4
Analyze external partner authentication requirements.
Select SAML/WS-Fed Direct Federation to delegate authentication to the partner's non-Azure identity provider without manual invitation overhead.
To satisfy the external partner access requirement.

Anahtar Kavram

Selecting appropriate Microsoft Entra ID hybrid identity and multi-tenant solutions based on security, availability, and provisioning constraints.
Tahmini Süre:2m 30s
Soru 124Soru →

An organization wants to protect administrative privileges for Azure resources by enforcing just-in-time (JIT) access and requiring manager approval before roles are activated. Which of the following configurations should you include in the identity governance design? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the user assignments for the administrative roles as eligible in Microsoft Entra Privileged Identity Management (PIM).; Enable the 'Require approval to activate' setting in the Microsoft Entra Privileged Identity Management (PIM) role settings.

Cevap

Configure role assignments as eligible in Privileged Identity Management (PIM) and require activation approval in the role configurations.
To secure administrative access with just-in-time controls and approvals, the design must use Microsoft Entra Privileged Identity Management (PIM). Users should be assigned as eligible for the roles, which requires them to activate the role when needed. To implement the authorization step, the role's settings must be modified to require approval to activate.

Adım Adım Çözüm

1
Analyze how to enforce just-in-time (JIT) administrative access.
Determine that standing privileges should be removed and replaced with eligible role assignments in Microsoft Entra Privileged Identity Management (PIM).
Eligible assignments require users to perform a deliberate activation step to receive their privileges, rather than having them active by default.
2
Analyze how to require manager approval for activation.
Configure the role activation settings in Microsoft Entra PIM to require approval and specify the designated approvers.
This configuration prevents immediate auto-activation of the role and routes the request to an approver first.

Anahtar Kavram

Microsoft Entra Privileged Identity Management (PIM) provides time-bound and approval-based role activation to secure resources by eliminating standing access, ensuring that roles are configured as eligible and subject to approval workflows.
Soru 125Soru →

An organization is designing an identity governance and privileged access strategy for a new Azure environment. The environment contains 15 subscriptions grouped under a single management group. The security team establishes the following requirements:
- External security auditors must be able to temporarily activate the Reader role at the management group level for up to 8 hours to perform quarterly audits. Activation must require approval from the SecOps manager and multi-factor authentication (MFA).
- The Azure Platform Engineers must have administrative access to the subscriptions, but their daily-use accounts must not have standing owner privileges.
- A break-glass emergency administrator account must be created to ensure access to the Microsoft Entra tenant if a federation outage occurs, and this account must bypass standard MFA blocks to prevent lockout.
- All access assignments must align with Azure security best practices and minimize administrative overhead.

Which design should you recommend to meet the requirements while adhering to Microsoft security best practices?

Cevabı ve açıklamayı göster

Cevap: Create a Microsoft Entra ID security group for the auditors and assign it as eligible for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as eligible for the Owner role. Exclude the emergency administrator account from the Conditional Access policy that enforces MFA for administrative portals.

Cevap

Create a Microsoft Entra ID security group for the auditors and assign it as eligible for the Reader role at the management group level using Privileged Identity Management (PIM) for Azure resources, configuring approval and MFA requirements on activation. Create a security group for the engineers and assign it as eligible for the Owner role. Exclude the emergency administrator account from the Conditional Access policy that enforces MFA for administrative portals.
The correct design uses security groups to assign both the auditors and engineers to their respective roles via Privileged Identity Management (PIM) for Azure resources, which reduces administrative overhead and aligns with the principle of least privilege by keeping assignments eligible rather than active. Additionally, excluding the emergency administrator account from the Conditional Access policy enforcing multi-factor authentication (MFA) prevents tenant lockout during an identity provider outage.

Adım Adım Çözüm

1
Determine the appropriate method for assigning roles to the external security auditors and platform engineers.
Both groups should be assigned roles via Entra security groups (rather than individual accounts) to ensure scalable management and compliance with RBAC best practices.
Assigning roles directly to users increases administrative overhead and violates standard delegation practices.
2
Identify the proper PIM assignment type to satisfy the requirement that daily-use accounts do not have standing privileges and access must be time-bound.
The security groups must be configured as 'eligible' in PIM for Azure Resources, allowing users to activate the roles only when needed (just-in-time access).
Setting the PIM assignments to 'active' gives standing access to the security groups, which defeats the goal of JIT access.
3
Design the Conditional Access policy for administrative access and evaluate the impact on the emergency administrator account.
The emergency administrator account must be excluded from the CA policy requiring MFA.
If the identity provider or MFA service experiences an outage, administrators could be locked out. The emergency account is a critical recovery mechanism and must not require MFA.

Anahtar Kavram

Privileged access management, just-in-time role activation, group-based RBAC, and emergency account governance in Microsoft Entra ID.
Tahmini Süre:3m 0s
Soru 126Soru →

A company is planning to migrate an on-premises database environment to Azure. The environment consists of two databases that perform frequent cross-database queries. The migration must satisfy the following requirements:
- Minimize the administrative overhead of managing the underlying operating system and virtual machines.
- Support the execution of existing SQL Server Agent jobs.
- Support cross-database queries between the two databases.
- Ensure the databases are accessible via a private IP address within a virtual network.

Which two Azure SQL options can satisfy these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance General Purpose; Azure SQL Managed Instance Business Critical

Cevap

The correct options are Azure SQL Managed Instance General Purpose and Azure SQL Managed Instance Business Critical.
Azure SQL Managed Instance (both General Purpose and Business Critical tiers) provides near 100% compatibility with the latest SQL Server database engine. It includes a built-in SQL Server Agent, supports cross-database queries using three-part names, and is natively deployed within a subnet of an Azure Virtual Network (VNet) to secure access via a private IP address. As a fully managed PaaS solution, it eliminates the administrative overhead of managing the operating system and virtual machine infrastructure.

Adım Adım Çözüm

1
Evaluate the management overhead requirement.
SQL Server on Azure Virtual Machines is identified as an Infrastructure-as-a-Service (IaaS) solution requiring OS management, making it unsuitable.
The scenario requires minimizing administrative overhead of the operating system and VMs.
2
Evaluate feature compatibility for SQL Server Agent and cross-database queries.
Azure SQL Database (single database and elastic pool) does not support these native SQL features, whereas Azure SQL Managed Instance supports both.
The database needs to preserve SQL Server Agent jobs and support cross-database queries.
3
Identify the service tiers that satisfy all requirements.
Both the General Purpose and Business Critical service tiers of Azure SQL Managed Instance provide the required native feature set and managed environment.
Service tiers within Managed Instance share the same core database engine compatibility features.

Anahtar Kavram

Selecting the appropriate Azure SQL deployment option based on compatibility requirements and management overhead.
Soru 127Soru →

An enterprise is designing a subscription governance strategy for a multi-region deployment consisting of 12 Azure subscriptions. The subscriptions are grouped under a single department-level Management Group. A security audit team consisting of 15 members requires read-only access to all resources within these subscriptions to perform periodic audits.

The solution must satisfy the following requirements:
- Access must be granted only when actively auditing and must automatically expire after 8 hours.
- Access requests must require approval from the security manager.
- The solution must minimize administrative overhead and enforce the principle of least privilege.

Which configuration should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a Microsoft Entra ID security group containing the audit team members. Configure a Microsoft Entra Privileged Identity Management (PIM) eligible group assignment for the Reader role at the Management Group scope, requiring approval and setting a maximum activation duration of 8 hours.

Cevap

Create a Microsoft Entra ID security group containing the audit team members, and configure a Microsoft Entra Privileged Identity Management (PIM) eligible group assignment for the Reader role at the Management Group scope, requiring approval and setting a maximum activation duration of 8 hours.
The correct configuration uses group-based access control combined with Microsoft Entra Privileged Identity Management (PIM) at the Management Group scope. By defining the security group as eligible rather than active, the audit team members must request activation to obtain the Reader role. This request goes through an approval workflow and automatically expires after the configured 8-hour duration, fully aligning with the principle of least privilege.

Adım Adım Çözüm

1
Consolidate the users into a single administrative unit by creating a Microsoft Entra ID security group and adding all 15 audit team members as members.
This satisfies the requirement to minimize administrative overhead by avoiding individual user assignments.
Identity governance best practices dictate managing access via security groups rather than individual user accounts.
2
Configure the security group as eligible for the Reader role at the Management Group scope containing the 12 subscriptions in Microsoft Entra PIM.
The Reader permissions are inherited by all subscriptions within the Management Group hierarchy, ensuring full audit visibility.
Assigning permissions at the Management Group scope ensures that permissions inherit down to all child subscriptions automatically.
3
Configure the PIM role settings for the Reader role to require approval from the security manager and limit the maximum activation duration to 8 hours.
Auditors must explicitly request activation, which requires approval and automatically revokes access after 8 hours.
This implements the just-in-time (JIT) access model and enforces the principle of least privilege.

Anahtar Kavram

Just-in-Time (JIT) access governance using Microsoft Entra PIM and group-based RBAC at the Management Group scope.
Soru 128Soru →

An international retail company hosts containerized application workloads in Azure across the UK South and Southeast Asia regions. To meet governance and compliance requirements, you must design a monitoring and log routing solution that satisfies the following criteria:

- Data Residency: Diagnostic logs generated by resources in Southeast Asia must remain within Southeast Asia, and logs generated in UK South must remain within the UK.
- Access Control: Application development teams must only be able to view logs for their own resources, without being granted permissions to the underlying Log Analytics workspace or logs of other teams.
- Log Enforcement: All newly deployed resources must automatically have diagnostic settings configured to route logs to the appropriate workspace. Non-compliant deployments must be remediated automatically without blocking the resource provisioning process.

Which design strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy one Log Analytics workspace in UK South and one in Southeast Asia. Enable resource-context access on both workspaces, assign Reader roles on the resource groups to the development teams' Microsoft Entra ID groups, and assign an Azure Policy with a DeployIfNotExists effect.

Cevap

Deploy one Log Analytics workspace in UK South and one in Southeast Asia. Enable resource-context access on both workspaces, assign Reader roles on the resource groups to the development teams' Microsoft Entra ID groups, and assign an Azure Policy with a DeployIfNotExists effect.
The correct strategy uses separate Log Analytics workspaces in UK South and Southeast Asia to meet regional data residency constraints. Enabling resource-context access and assigning resource-group level Reader permissions to Microsoft Entra ID groups ensures that developers can only query logs for resources they own, following security best practices. The DeployIfNotExists Azure Policy automatically deploys diagnostic settings for new resources, achieving compliance without interrupting the deployment workflow.

Adım Adım Çözüm

1
Determine workspace layout for data residency.
Logs must stay within their respective regions, so separate workspaces are required in UK South and Southeast Asia.
A single global workspace would cause Southeast Asia log data to be exported to UK South, violating regional residency rules.
2
Determine Azure Policy effect for automatic enforcement.
Use the DeployIfNotExists policy effect to automatically configure diagnostic settings.
The DeployIfNotExists effect automatically deploys diagnostic settings for new resources without blocking the deployment, whereas a Deny effect would block provisioning if settings are not defined in the deployment template.
3
Determine RBAC and access control configuration.
Enable resource-context access on the workspaces and assign Reader roles on the resource groups to the teams' Microsoft Entra ID groups.
Resource-context access allows developers to query logs of resources they have access to without workspace administrative permissions. Using Entra ID groups aligns with RBAC best practices instead of assigning roles to individual accounts.

Anahtar Kavram

Designing regional log routing, access control via resource-context RBAC, and policy-driven log enforcement.
Soru 129Soru →

An enterprise logistics organization plans to migrate its legacy on-premises supply chain management system to Microsoft Azure. The system's relational database layer consists of multiple databases that have the following characteristics and requirements:

* Regular execution of SQL Server Agent jobs that initiate SQL Server Integration Services (SSIS) packages stored in the database.
* Cross-database queries using three-part and four-part names to join transactional and historical shipping data.
* Execution of SQL Common Language Runtime (CLR) integration with strict security assemblies for custom telemetry calculations.
* Strict network isolation requiring the database to reside inside a dedicated Azure Virtual Network subnet with no public internet routing.
* Minimization of administrative effort for patching the operating system and managing database backups.

Which Azure SQL deployment option should you recommend to meet all requirements?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Managed Instance

Cevap

Azure SQL Managed Instance
Azure SQL Managed Instance is the correct recommendation because it provides near 100% compatibility with the on-premises SQL Server database engine. It supports SQL Server Agent, cross-database queries, and CLR integration. Because it is a platform as a service (PaaS) deployment, Azure automates operating system updates, patches, and database backups. Furthermore, Managed Instance is deployed natively into an Azure Virtual Network subnet, satisfying the network security and isolation requirements.

Adım Adım Çözüm

1
Analyze database engine requirements.
SQL Server Agent, SQL CLR, and native cross-database queries with three-part or four-part names require an instance-level deployment or VM.
Azure SQL Database single database and Elastic Pools do not support instance-level features like SQL Agent and native cross-database queries using multi-part names.
2
Evaluate network isolation requirements.
Both Azure SQL Managed Instance and SQL Server on Azure VMs natively support deployment inside a private Virtual Network (VNet) subnet.
This excludes public endpoints and meets the strict network isolation criteria.
3
Compare administrative overhead constraints.
Azure SQL Managed Instance is a PaaS service that automates OS patching and database backups, whereas SQL Server on Azure VMs is an IaaS service that leaves OS patching and database management to the customer.
Azure SQL Managed Instance meets all database feature, network, and administrative overhead requirements.

Anahtar Kavram

Selecting the optimal Azure SQL deployment based on legacy database engine features and management overhead.
Soru 130Soru →

Zephyr Aerospace has an on-premises Active Directory Domain Services (AD DS) domain. The company is designing a hybrid identity solution to integrate their on-premises identity infrastructure with Microsoft Entra ID.

The solution must meet the following requirements:
- Users must be able to sign in to cloud services using their on-premises passwords.
- Users must be able to authenticate successfully even if the on-premises network connectivity is temporarily unavailable.
- The security team must be able to identify if any user credentials have been leaked on the public dark web.
- The on-premises infrastructure footprint and administrative overhead must be minimized.

Which hybrid identity authentication method should you recommend?

Cevabı ve açıklamayı göster

Cevap: Password Hash Synchronization (PHS)

Cevap

Password Hash Synchronization (PHS)
Password Hash Synchronization (PHS) is the correct choice because it meets all requirements. By storing a hash of the user's password hash in Microsoft Entra ID, authentication is handled entirely in the cloud. This provides resiliency if the on-premises network is offline. It also enables leaked credential detection via Microsoft Entra ID Protection and has the lowest on-premises infrastructure footprint compared to PTA and AD FS.

Adım Adım Çözüm

1
Evaluate the offline availability requirement.
Since users must authenticate even during on-premises network outages, cloud-side authentication is necessary.
Methods requiring real-time on-premises validation (standard PTA and AD FS) are ruled out because they depend on an active connection to on-premises domain controllers.
2
Evaluate the security and threat detection requirement.
Leaked credential detection is required.
Microsoft Entra ID Protection requires Password Hash Synchronization (PHS) to run its leaked credential checks by comparing hashes to compromised lists.
3
Evaluate the management overhead constraint.
The infrastructure footprint must be minimized.
AD FS requires federation servers, proxies, and certificates, while PTA requires multiple agent installations. PHS only requires the sync engine, minimizing overhead.

Anahtar Kavram

Selecting a hybrid identity authentication model that provides cloud-based resiliency, minimal on-premises infrastructure, and integration with advanced security features such as leaked credential detection.
Soru 131Soru →

An enterprise organization is planning a secure governance and privileged access strategy for their Azure environment. The environment consists of multiple subscriptions under a single management group. The strategy must satisfy the following requirements:

- The operations team requires temporary, time-bound access to manage virtual machines within specific resource groups. The access must be requested, require multi-factor authentication (MFA) during activation, and require approval from the operations manager.
- A security compliance audit of all privileged roles must be performed quarterly. If an administrator fails to complete their review of a user's role assignment within the review window, that user's access must be automatically revoked.
- To guard against tenant lockout during a major identity or MFA provider outage, two emergency-access accounts must be established with administrative access while minimizing the risk of lockout.

Which two configurations should you include in the design to meet the requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a security group containing the operations team members, assign the group as eligible for the Virtual Machine Contributor role in Microsoft Entra Privileged Identity Management (PIM), and configure PIM settings to require MFA and approval for activation.; Configure Microsoft Entra Access Reviews for the privileged roles, set the recurrence to quarterly, and configure the settings to automatically apply results and remove access if reviewers do not respond.

Cevap

The correct configurations are to configure a security group with eligible assignments in PIM requiring MFA and approval, and to configure quarterly Access Reviews that automatically remove access on non-response.
The solution requires implementing a secure, scalable governance model. Eligible role assignments in PIM for a security group enforce just-in-time access, requiring MFA and approval for activation. Quarterly Access Reviews with the auto-apply configuration set to remove access on non-response ensure automated compliance enforcement. Lastly, emergency-access accounts must be excluded from MFA policies to prevent lockout.

Adım Adım Çözüm

1
Analyze privileged access requirements for the operations team.
Determine that just-in-time access via PIM using group-based eligible assignments is the optimal way to provide temporary, audited access with approval workflows.
Using group-based eligible assignments in PIM reduces administrative overhead and aligns with the principle of least privilege.
2
Address the requirement for automatic revocation during access reviews.
Identify Microsoft Entra Access Reviews as the tool to schedule quarterly audits, configuring the non-response behavior to automatically remove access.
This satisfies the governance requirement to revoke access when reviewers fail to respond to the audit.
3
Evaluate the configuration of emergency-access accounts.
Recognize that emergency-access accounts must be excluded from Conditional Access policies requiring MFA to prevent lockout during MFA outages.
Ensures continuity of administrative access under disaster recovery scenarios.

Anahtar Kavram

Microsoft Entra ID Governance and PIM design including JIT access, Access Reviews, and emergency account configuration.
Soru 132Soru →

An organization is designing the deployment of a new transaction processing system. The database is projected to grow to 55 TB within the first year. The operations team requires that database backups and restores complete in less than 10 minutes, regardless of the size of the database. The solution must minimize administrative effort. Which Azure SQL option should you recommend?

Cevabı ve açıklamayı göster

Cevap: Azure SQL Database Hyperscale

Cevap

Azure SQL Database Hyperscale
Azure SQL Database Hyperscale is a cloud-native PaaS solution that supports database sizes up to 100 TB. Its unique storage architecture separates compute from storage and utilizes page servers to perform rapid, file-snapshot-based backups and restores that complete in minutes, independent of the database size. This meets both the 55 TB size requirement, the strict recovery time targets, and the managed service requirement.

Adım Adım Çözüm

1
Analyze the capacity requirement of 55 TB and identify which relational offerings support this scale.
Only Hyperscale (up to 100 TB) and SQL Server on Azure VMs (up to storage limit) support a 55 TB single database. The General Purpose and Business Critical tiers of Azure SQL Database are limited to 4 TB or 16 TB.
Eliminates General Purpose and Business Critical tiers based on database size constraints.
2
Evaluate the backup and restore performance requirement of under 10 minutes for a 55 TB database.
Hyperscale uses a multi-tier storage architecture with page servers, allowing file-snapshot backups that complete in minutes regardless of data volume. Traditional SQL Server backup/restore methods on VMs would scale with the data size and require extensive custom engineering to meet this time threshold.
Identifies the unique architectural feature of Hyperscale that satisfies the time-constrained RTO/RPO.
3
Compare administrative overhead between the remaining options.
Azure SQL Database Hyperscale is a fully managed PaaS solution, whereas SQL Server on Azure VMs requires the organization to manage the OS, database engine patching, and infrastructure maintenance.
Confirms that Hyperscale satisfies the requirement to minimize administrative effort.

Anahtar Kavram

Azure SQL Database Hyperscale features and limits
Soru 133Soru →

You are designing the storage infrastructure for a business-critical SQL Server database running on an Azure Virtual Machine. You have the following requirements:
- The database transaction logs require high IOPS and low, consistent write latency.
- The database backups must be stored in Azure Blob Storage and must remain available if a primary datacenter experiences a local power or cooling failure.
- Storage costs for the backups must be minimized.

Which storage configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy the transaction logs on Premium SSD Managed Disks, and store the backups in a Zone-Redundant Storage (ZRS) blob container.

Cevap

Deploy the transaction logs on Premium SSD Managed Disks, and store the backups in a Zone-Redundant Storage (ZRS) blob container.
The correct answer provides the optimal balance of performance and availability for the stated requirements. Premium SSD Managed Disks are recommended for transaction logs to meet the high IOPS and low-latency demands of database operations. For backups, Zone-Redundant Storage (ZRS) satisfies the requirement to survive a datacenter outage by replicating data across three separate zones, while avoiding the higher cost of geo-redundant alternatives.

Adım Adım Çözüm

1
Analyze the performance requirements for the database transaction logs.
Database transaction logs require high IOPS and low write latency, which means Standard HDD or Standard SSD managed disks are insufficient; Premium SSD (or Ultra Disk) is required.
Choosing low-tier storage for write-intensive database operations leads to performance bottlenecks and application latency.
2
Analyze the redundancy and cost requirements for the backup storage.
The backups must survive a local datacenter-level failure (power/cooling outage), which rules out Locally Redundant Storage (LRS). Since costs must be minimized, Zone-Redundant Storage (ZRS) is selected instead of Geo-Redundant Storage (GRS).
ZRS replicates data across three separate Availability Zones in the primary region, providing resilience against datacenter outages at a lower cost than replicating to a secondary region.
3
Combine the storage disk and backup redundancy requirements to select the best option.
The correct combination is Premium SSD Managed Disks for transaction logs and ZRS blob storage for backups.
This configuration satisfies all requirements for performance, resilience, and cost optimization.

Anahtar Kavram

Selecting appropriate Azure Managed Disk types based on database performance requirements, and choosing the optimal Azure Storage redundancy tier based on resilience goals and cost.
Tahmini Süre:1m 30s
Soru 134Soru →

A university IT department needs to grant student helpdesk assistants the ability to reset user passwords in Microsoft Entra ID. To minimize security risks and ensure compliance with the principle of least privilege, the students must only have the User Administrator role active when they are on shift and actively resolving tickets.

Which Microsoft Entra Privileged Identity Management (PIM) configuration should you recommend for the student accounts?

Cevabı ve açıklamayı göster

Cevap: Configure the student accounts as eligible for the User Administrator role, requiring them to activate the role when starting a shift.

Cevap

Configure the student accounts as eligible for the User Administrator role, requiring them to activate the role when starting a shift.
Configuring the student helper accounts as eligible for the User Administrator role requires them to perform an activation process (which can include MFA verification and justification) to gain administrative access. The role automatically deactivates after their shift, fulfilling the requirement for time-bound access and adhering to the principle of least privilege.

Adım Adım Çözüm

1
Identify the requirement for temporary, time-bound privileged access.
Microsoft Entra Privileged Identity Management (PIM) must be utilized to implement just-in-time role activation.
PIM ensures that administrative privileges are not persistently active on the accounts.
2
Choose between an eligible or active role assignment in PIM.
Select an eligible assignment type rather than active.
Eligible assignments require users to explicitly activate the role only when needed (e.g., during their shift), whereas active assignments grant persistent privileges.

Anahtar Kavram

Microsoft Entra ID Privileged Identity Management (PIM) enables just-in-time (JIT) and time-bound role activations. Eligible assignments enforce the principle of least privilege by ensuring permissions are only active when requested and authorized.
Soru 135Soru →

You are designing a storage solution for a database application. You have the following requirements:
- The database transaction logs must be stored on virtual machine disks that support high IOPS and low latency.
- The database backup files must be stored in a storage account and must survive a datacenter zone failure in the primary region.
- Application servers must access the backups using a Shared Access Signature (SAS) token that remains valid for one year, with the ability to immediately revoke access if the token is compromised.

Which two configurations should you include in your design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Zone-redundant storage (ZRS) for the backup storage account; A stored access policy associated with the SAS token for backup access

Cevap

The correct configurations are Zone-redundant storage (ZRS) for the backup storage account and a stored access policy associated with the SAS token.
Zone-redundant storage (ZRS) replicates data synchronously across three availability zones in the primary region, ensuring the backups survive a zone failure. Additionally, associating the SAS token with a stored access policy allows you to revoke or change the permissions of the SAS token immediately by modifying or deleting the policy.

Adım Adım Çözüm

1
Determine the redundancy type required to survive a datacenter zone failure.
Zone-redundant storage (ZRS) is selected.
ZRS replicates data across three separate availability zones within the primary region, whereas Locally Redundant Storage (LRS) is restricted to a single datacenter.
2
Determine the secure access method that allows token revocation.
A stored access policy is selected.
An ad-hoc SAS token cannot be revoked without rotating storage account keys, which affects all users. A stored access policy can be updated or deleted to revoke associated tokens immediately.
3
Evaluate disk type performance for database transaction logs.
Standard HDD is avoided; higher performance disk classes like Premium SSD or Ultra Disk are preferred.
Standard HDD disks are slow and do not meet the low-latency, high-IOPS requirement of database transaction logging.

Anahtar Kavram

Selecting Azure storage redundancy tiers, disk types, and SAS token revocation mechanisms based on application performance, durability, and security requirements.
Soru 136Soru →

A financial organization is designing a governance and monitoring solution for its Azure environment. The security team requires that all newly deployed virtual machines and Azure SQL databases automatically route their diagnostic logs to a central Azure Event Hubs namespace for ingestion into a third-party SIEM. The solution must ensure that resource deployments by application teams are never blocked, and any resource deployed without a diagnostic setting is automatically corrected to comply with the logging requirement.

Which configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: An Azure Policy definition with the DeployIfNotExists effect that deploys diagnostic settings pointing to the Event Hubs namespace, assigned at the subscription level.

Cevap

An Azure Policy definition with the DeployIfNotExists effect that deploys diagnostic settings pointing to the Event Hubs namespace, assigned at the subscription level.
The correct configuration uses Azure Policy with the DeployIfNotExists effect assigned at the subscription level. This effect allows the resource deployment to proceed normally and automatically deploys diagnostic settings to route logs to the Event Hubs namespace if they are missing, satisfying the non-blocking and automated remediation requirements.

Adım Adım Çözüm

1
Determine the appropriate Azure Policy effect to satisfy the non-blocking automation requirement.
DeployIfNotExists is selected over Deny because it automatically remediates non-compliant resources upon creation without blocking the deployment.
The requirement specifies that resource deployments must never be blocked, ruling out the Deny effect.
2
Define the target destination for the diagnostic logs.
The policy must deploy diagnostic settings configured to send logs to the Azure Event Hubs namespace.
The organization requires logs to be routed to an Event Hubs namespace for ingestion into a third-party SIEM.
3
Assign the policy at the subscription scope.
The policy is assigned to the subscription level to cover all newly deployed virtual machines and Azure SQL databases.
Assigning at the subscription level ensures governance compliance for all resources under that subscription.

Anahtar Kavram

Azure Policy DeployIfNotExists effect for automatic diagnostic setting deployment and log routing compliance.
Soru 137Soru →

You are designing a data storage solution using Azure Cosmos DB for a multi-region retail application. The application requires global distribution across three Azure regions, a 99.999% availability SLA for both reads and writes, and a 90/10 read-to-write ratio. Match each application workload to the most appropriate Azure Cosmos DB API.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

API for NoSQL
API for MongoDB
API for Gremlin

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

API for NoSQL matches the customer order catalog; API for MongoDB matches the shopping cart session service migrating from MongoDB; API for Gremlin matches the recommendation engine traversing relationships.
The API for NoSQL is the native document model using SQL query syntax. The API for MongoDB supports wire-protocol compatibility for existing MongoDB codebases. The API for Gremlin supports graph databases using vertices and edges.

Adım Adım Çözüm

1
Identify the data model and query language requirements for the customer order catalog workload.
The catalog requires JSON document storage and SQL querying, which directly aligns with the native Azure Cosmos DB API for NoSQL.
Matching workloads to their native APIs minimizes translation layers and provides the best performance and tooling support.
2
Identify the compatibility requirements for the shopping cart session service.
The workload is migrating from MongoDB and requires compatibility without application code changes, which maps to the API for MongoDB.
The API for MongoDB implements the wire protocol of MongoDB, allowing existing drivers and tools to work out-of-the-box.
3
Identify the relationship and traversal requirements for the recommendation engine.
The engine requires traversing relationships between entities, representing a graph data structure, which maps to the API for Gremlin.
The API for Gremlin supports property graphs and the Gremlin query language, which is standard for graph database traversals.

Anahtar Kavram

Azure Cosmos DB API selection based on workload data models and compatibility requirements.
Soru 138Soru →

Caelum Skyworks is designing a hybrid identity solution that integrates their on-premises Active Directory Domain Services (AD DS) forest with a new Microsoft Entra ID tenant.

The design must meet the following requirements:
- Users must authenticate to cloud resources using their on-premises passwords.
- Users must be able to sign in to cloud applications even if the on-premises datacenter or its internet connection is offline.
- Users must be allowed to reset their own passwords in Microsoft Entra ID, and these changes must instantly reflect on-premises.
- A Conditional Access policy requiring Multi-Factor Authentication (MFA) for administrative roles must exclude a dedicated emergency break-glass account to prevent tenant lockout.
- Just-in-time administrative access must be used to manage Azure resources.

Which two actions should you include in the design to meet the requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure Password Hash Synchronization (PHS) and enable password writeback in Microsoft Entra Connect.; Deploy a Conditional Access policy requiring MFA for all administrators, excluding the emergency access account.

Cevap

The correct configuration requires configuring Password Hash Synchronization (PHS) with password writeback in Microsoft Entra Connect, and deploying a Conditional Access policy requiring MFA for all administrators while excluding the emergency access account.
To satisfy both authentication and business continuity during an on-premises outage, Password Hash Synchronization (PHS) must be utilized because Entra ID acts as the authority without needing to contact on-premises domain controllers. Password writeback must be enabled in Microsoft Entra Connect to support bidirectional SSPR. Additionally, to enforce MFA for administrators while protecting the tenant against lockout, a Conditional Access policy should require MFA for administrative roles but explicitly exclude the emergency access account.

Adım Adım Çözüm

1
Analyze the authentication and resilience requirements.
Password Hash Synchronization (PHS) must be chosen. Pass-through Authentication (PTA) and Active Directory Federation Services (AD FS) rely on real-time on-premises connectivity, which fails when the datacenter is offline.
Ensures authentication business continuity during on-premises outages.
2
Determine the configuration needed for self-service password reset (SSPR) to sync back on-premises.
Enable password writeback in Microsoft Entra Connect.
Allows cloud-initiated password changes to be written back to the on-premises directory instantly.
3
Evaluate the administrative access policy and lockout prevention requirements.
A Conditional Access policy requiring MFA for administrators must be deployed, with the emergency access account added to the exclusions list.
Protects administrative roles while avoiding lockout scenarios by maintaining an unmanaged, highly secure emergency account.

Anahtar Kavram

Designing a secure, resilient hybrid identity solution with Microsoft Entra ID and Microsoft Entra Connect
Soru 139Soru →

A retail corporation is planning the deployment of a high-throughput transactional database system on Azure. The system must meet the following requirements:

* Maintain transaction log write latencies under 1 millisecond.
* Allow database administrators to execute legacy Common Language Runtime (CLR) functions using unsafe assembly permissions.
* Ensure that both the operating system and database engine updates are automatically applied by the cloud provider.
* Restrict all database ingress traffic to a dedicated private IP address within a customer-managed virtual network.

Which relational database solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Business Critical service tier of Azure SQL Managed Instance

Cevap

Business Critical service tier of Azure SQL Managed Instance
The Business Critical service tier of Azure SQL Managed Instance meets all requirements. It is a fully managed PaaS solution where Microsoft automatically patches both the operating system and the database engine. It supports advanced SQL Server features, including unsafe CLR assemblies. Because it natively integrates with virtual networks, it provides secure ingress via a private IP address. Finally, the Business Critical tier uses local SSD storage for data and log files, delivering sub-millisecond write latencies for the transaction logs.

Adım Adım Çözüm

1
Analyze CLR capability requirements.
Identify that Azure SQL Database does not support custom CLR assemblies, whereas Azure SQL Managed Instance and SQL Server running on Azure Virtual Machines support CLR including unsafe assemblies.
Eliminates Azure SQL Database from the candidates.
2
Evaluate administrative and patching requirements.
Identify that SQL Server on Azure Virtual Machines requires the user to manage operating system updates, whereas Azure SQL Managed Instance handles OS and engine patching automatically.
Eliminates SQL Server on Azure Virtual Machines.
3
Evaluate storage performance and write latency requirements.
Identify that the General Purpose tier of Azure SQL Managed Instance uses remote Azure Premium Storage (resulting in higher latency), whereas the Business Critical tier uses fast local SSD storage to achieve sub-millisecond transaction log write latency.
Differentiates between Managed Instance service tiers and selects the Business Critical tier.

Anahtar Kavram

Azure SQL Managed Instance service tiers and compatibility
Tahmini Süre:3m 0s
Soru 140Soru →

Your company has an Azure landing zone with a Management Group named Production-MG, which contains multiple subscriptions. You are designing a governance strategy for a team of system administrators.

The administrators must be able to start, stop, and restart Azure Virtual Machines within all subscriptions under Production-MG. They must not be able to perform any other actions on the virtual machines, such as creating, deleting, or modifying them. You must enforce the principle of least privilege, minimize administrative overhead, and ensure that administrative access is granted only when required for active maintenance tasks.

Which design strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Define a custom Azure RBAC role with the assignable scope set to the Production-MG management group and the Actions array configured with explicit read, start, powerOff, and restart permissions. Create a Microsoft Entra ID security group containing the administrators, assign the custom role to this group at the Production-MG scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to make the security group members eligible for the role.

Cevap

Define a custom Azure RBAC role with the assignable scope set to the Production-MG management group and the Actions array configured with explicit read, start, powerOff, and restart permissions. Create a Microsoft Entra ID security group containing the administrators, assign the custom role to this group at the Production-MG scope, and configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources to make the security group members eligible for the role.
The correct strategy involves defining a custom Azure RBAC role with explicit virtual machine power action permissions scoped to the Production-MG management group. Assigning this role to a Microsoft Entra ID security group at the management group level ensures that all subscriptions underneath inherit the permissions, minimizing administrative overhead. Configuring Microsoft Entra Privileged Identity Management (PIM) with eligible assignments ensures just-in-time (JIT) access, allowing administrators to activate the role only during active maintenance windows, which complies with the principle of least privilege.

Adım Adım Çözüm

1
Define a custom Azure RBAC role with the minimum required actions at the Production-MG scope.
The role permissions are restricted to explicit read and virtual machine action operations (read, start, powerOff, and restart), preventing other management actions.
This enforces the principle of least privilege by ensuring administrators only have the specific permissions needed for virtual machine power state operations.
2
Create a Microsoft Entra ID security group and assign the custom RBAC role to this group at the Production-MG scope.
Permissions inherit down to all subscriptions and resource groups under Production-MG without needing individual resource-level role assignments.
Assigning roles to groups instead of individual users minimizes administrative overhead and adheres to identity governance best practices.
3
Configure Microsoft Entra Privileged Identity Management (PIM) for Azure resources, setting the administrators' assignments as eligible.
Administrators do not have active access by default, but can request just-in-time activation of the role when needed for maintenance tasks.
This satisfies the requirement that administrative access is granted only when required for active tasks, reducing the attack surface.

Anahtar Kavram

Azure RBAC, Management Groups, and Just-In-Time Access Governance
ÖncekiSayfa 7 / 60Sonraki
Tüm alıştırma soruları — Microsoft Azure Solutions Architect (AZ-305) | Examkin