Tüm alıştırma soruları

Gideon Robotics is designing a hybrid identity and multi-tenant collaboration solution. The company has an on-premises Active Directory Domain Services (AD DS) forest containing 4,500 users. Gideon Robotics recently acquired AeroDynamics Inc., which uses a separate Microsoft Entra ID tenant.

You need to design an identity solution that meets the following requirements:
- Authentication: Synchronize on-premises users to the primary Gideon Robotics Microsoft Entra ID tenant. The method must have the lowest on-premises footprint, require no inbound network ports, and support the detection of leaked credentials in the cloud.
- Self-Service: Enable synchronized users to reset their own passwords in the cloud, with the changes automatically writing back to the on-premises Active Directory domain.
- Business Continuity: Authentication services must remain operational in the event of an outage of the on-premises network or domain controllers.
- Multi-Tenant Collaboration: Allow users from the AeroDynamics tenant to access shared applications in the Gideon Robotics tenant using their existing credentials, while ensuring their devices meet compliance policies configured in their home tenant.

Which two components should you include in the design to meet these requirements? (Select two.)

A utility company is designing a serverless backend architecture to process smart meter telemetry and host a customer-facing billing API. The solution must meet the following requirements:

* Telemetry processing: Ingestion triggers a job that aggregates and stores data streams. Each execution takes up to $15$ minutes to complete.
* Billing API: Must support peak hourly traffic of $5,000$ requests, experience minimal latency during sudden scale-up (no cold starts), and require direct integration with an Azure Virtual Network (VNet).
* Operational overhead: Must be minimized.

Which two Azure hosting options should you recommend to meet these requirements? (Select TWO.)

A fintech platform is designing the networking architecture for a single-region deployment in West US 3. The design must accommodate two distinct workloads:

1. An administrative web portal that requires SSL/TLS termination and URL path-based routing (routing `/api/*` to an API service and `/reports/*` to a reporting service).
2. A high-frequency transaction ingestion service that communicates over a custom TCP protocol on port 9000 and requires extremely low latency.

To ensure resilience, all entry-point load balancers must utilize zone-redundant public IP addresses. The virtual machines hosting the transaction ingestion service currently have Basic SKU public IP addresses assigned to their network interfaces.

Which two actions should you include in the network design to meet these requirements while preventing deployment validation errors?

A company is designing a storage solution for a document management application. The documents must be stored in Azure Blob Storage.

The solution must meet the following requirements:
- If an entire Azure region suffers a major outage, the storage solution must remain resilient and prevent data loss.
- Access to the files must be granted to external vendors using Shared Access Signatures (SAS) that can be invalidated immediately if a security compromise is suspected.

Which two storage configurations should you recommend to meet the requirements?

An organization is designing the storage infrastructure for a new containerized application workflow on Azure. The architecture must satisfy the following technical requirements:

- Provide a shared, POSIX-compliant file system for a cluster of Linux nodes that supports the NFS v4.1 protocol and can withstand the outage of a single Availability Zone within the primary Azure region.
- Provide block storage for a transaction-intensive database workload that requires consistent sub-millisecond disk write latencies.

Which two storage configurations should you recommend? (Select two.)

An international logistics company is designing the data tier for a new transport management platform. The platform consists of two distinct subsystems:

* The tracking subsystem requires a database that supports cross-database queries, SQL Server Agent for scheduling route calculation jobs, and Common Language Runtime (CLR) integration. The solution must minimize operational overhead.
* The invoicing subsystem requires a single database that experiences highly variable traffic patterns, including long periods of zero activity. The solution must minimize compute costs during idle periods.

Which two Azure SQL services should you recommend to support the subsystems? (Select TWO).

A logistics company is designing an administration model for its Azure landing zones. The environment has a Management Group hierarchy with a root group named "Logistics-Root" and child groups for different business units.

The company has two specific requirements:
1. A compliance team needs to audit and review resource configurations across all subscriptions under the "Logistics-Root" management group.
2. A network operations team needs to troubleshoot and modify route tables and network security groups inside the subscriptions, but only during scheduled maintenance windows, requiring multi-factor authentication (MFA) and administrator approval before access is granted.

To meet these requirements, which two configurations should you include in the administrative design?

A healthcare provider plans to allow external clinical researchers to upload trial datasets to a specific Azure Blob Storage container. You need to design an access solution that meets the following requirements:
- The researchers must have write access for a maximum of 48 hours.
- You must be able to revoke access immediately if a security compromise is detected.
- The solution must minimize administrative effort.

Which two actions should you include in the design? (Select TWO.)

A healthcare organization is migrating an on-premises Electronic Health Record (EHR) system to Azure. The design requires configuring secure access to an Azure Storage account named ehrdata that contains sensitive patient medical images in a blob container.

The solution must meet the following security requirements:
- External partner radiologists must be granted temporary read-only access to the blob container for 7 days. This access must be immediately revocable at any time before the 7 days expire.
- Internal compliance auditors require access to review the data, and the configuration must enforce scalable access control using identity best practices.
- Security administrators must be able to rotate storage keys, but only during scheduled audit windows, requiring manager approval before they can perform this action.

Which three actions should you include in the storage security and access control design? (Select three.)

A company is planning the storage architecture for a new application. The business requirements state that the data must be replicated synchronously across three separate availability zones within the primary region to ensure high availability. Which two Azure Storage replication options should you recommend to meet this requirement? (Select two.)

A logistics corporation is designing a privileged identity architecture for its IT operations team. The team has 12 administrators who require the User Access Administrator role to manage permissions across several subscription groups. The design must ensure that these administrators do not have permanent administrative rights, must perform multi-factor authentication (MFA) to activate their privileges, and that the organization's break-glass accounts are never locked out of the tenant by conditional access policies. Which two configurations should you include in the identity design to meet these requirements?

An enterprise is designing a subscription governance and access management strategy for a new business unit's development workloads. The environment consists of multiple subscriptions grouped under a single Management Group. You need to delegate administrative access to a team of developers so they can manage Azure Virtual Machines and Azure App Services within these subscriptions. The solution must minimize administrative overhead when developers join or leave the team, prevent developers from permanently holding privileged roles, and adhere to the principle of least privilege. Which two actions should you include in the design? (Select two.)

A healthcare company is designing a container-based application on Azure to host a patient portal API. The application consists of several microservices that handle patient queries. The design must satisfy the following requirements:
- The microservices must scale down to zero instances when there is no incoming traffic to reduce costs.
- The application components must communicate privately and be isolated within an existing Azure virtual network.
- The solution must minimize administrative and infrastructure management overhead.
- Audit logs must be kept strictly isolated in their respective deployment regions to comply with data sovereignty regulations.

Which two configurations should you recommend?

OmniGene Diagnostics is designing a disaster recovery and business continuity solution for its genomic analysis application. The application writes raw gene sequencing data to an Azure Storage account. The solution must meet the following requirements:

- Protect data against a local datacenter (zone) outage in the primary region with zero data loss.
- Provide a Recovery Point Objective (RPO) of less than 15 minutes for regional outages.
- Provide a Recovery Time Objective (RTO) of less than 1 hour.
- Allow the secondary region application instance to read data immediately during a primary region outage without waiting for a failover.
- Support write operations in the secondary region if a prolonged primary region outage occurs.
- Minimize costs.

Which two configurations should you recommend to meet the requirements? (Select two.)

An organization is designing the routing configuration for a spoke virtual network named `vnet-spoke-prod` ($172.16.0.0/16$) in Microsoft Azure. The virtual network contains a subnet named `snet-web` ($172.16.1.0/24$).

`vnet-spoke-prod` is peered with a hub virtual network named `vnet-hub-prod` ($10.100.0.0/16$). The hub virtual network contains an Azure Firewall instance with the private IP address $10.100.1.4$.

You have the following requirements:
- All outbound traffic from `snet-web` to the internet must be routed through the Azure Firewall for security inspection.
- All traffic from `snet-web` to an external spoke virtual network named `vnet-spoke-corp` ($192.168.0.0/16$) must be routed through the Azure Firewall.
- All internal traffic within `vnet-spoke-prod` must bypass the firewall and route directly between resources using default Azure routing.

Which two routes should you add to the route table associated with `snet-web` to meet these requirements?

You are an Azure Solutions Architect designing a data storage solution for a global media streaming platform. The platform must store real-time user playback progress and watch history. The workload has a read-to-write ratio of approximately $40:60$. The solution must be distributed across three regions (East US, West Europe, and East Asia) to achieve sub-10ms write latency at the 99th percentile and support an active-active setup. The platform requires a 99.999% availability SLA for both reads and writes. High availability and regional disaster resilience must be guaranteed for all data, including database backups.

Which two configuration options should you include in the architectural design to meet these requirements? (Select TWO)

An enterprise is designing a hub-and-spoke virtual network topology in Azure to secure traffic between application tiers.

The hub virtual network, `vnet-useast-hub` ($10.100.0.0/16$), hosts an Azure Firewall with the private IP address $10.100.2.4$.

The app spoke virtual network, `vnet-useast-app` ($10.101.0.0/16$), contains two subnets:
* `web-subnet` ($10.101.1.0/24$)
* `api-subnet` ($10.101.2.0/24$)

The database spoke virtual network, `vnet-useast-db` ($10.102.0.0/16$), contains one subnet:
* `db-subnet` ($10.102.1.0/24$)

Both spoke virtual networks are peered with `vnet-useast-hub`. No direct peering exists between the spokes.

You need to design a routing solution that meets the following requirements:
1. All outbound traffic from `web-subnet` to `db-subnet` must be routed through the Azure Firewall in the hub.
2. All return traffic from `db-subnet` to `web-subnet` must also traverse the Azure Firewall.
3. Traffic between `web-subnet` and `api-subnet` within the app spoke must remain local and route directly without traversing the firewall.

Which of the following configurations should you implement to meet these requirements? (Select TWO.)

An organization needs to collect Azure diagnostic logs for resources deployed across two distinct regulatory jurisdictions (Europe and the US). The requirements are:

1. Europe diagnostic logs must remain resident in Europe.
2. US diagnostic logs must remain resident in the US.
3. Access to the logs must be granted to the security team using the most scalable and maintainable administrative model.

Which two configurations should you include in the monitoring and governance design?

Your company wants to enforce tagging standards for Azure storage accounts. You need to design an Azure Policy strategy that meets the following compliance requirements:

* If a storage account is deployed without the 'Environment' tag, the deployment must be blocked.
* If a storage account is deployed without the 'CostCenter' tag, the policy should automatically add the tag with a default value of 'Unassigned' during creation.

Which two Azure Policy effects should you recommend to meet these compliance requirements?

An organization is designing a monitoring and log routing architecture for application workloads deployed across two Azure regions: East US and North Europe. The solution must meet the following requirements:
- Regulatory compliance mandates that operational logs generated in North Europe must reside within the North Europe region and must not be accessible from the East US region.
- Resource owners must only be able to query logs for the specific Azure resources they own, without having access to other operational logs in the same workspace.
- Diagnostic settings for all newly created virtual machines must be configured automatically to route logs to the appropriate regional workspace.

Which two configurations should you include in the design to meet the requirements?